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AppleScript Essentials 


by Benjamin S, Waldie 

Introduction 
to Scripting 
Photoshop 


Over the past several months, we have focused on scriptable 
ways to interact with remote directories using applications like 
Fetch, Transmit, Cybercluck, and more. Now, we're going to 
switch gears a bit, and begin to discuss something that pertains 
more to the creative side of the Macintosh market. Were going 
to begin looking at scriptable graphics programs. This months 
column wall provide an introduction to scripting Photoshop, tile 
professional-level image editing application front Adobe, 

First, a bit of history. Interestingly, Photoshop did not 
support AppleScript automation natively until version 7, Prior to 
this, however, users were able to automate Photoshop 5 and 6 
with the use of PhotoSctipter, a third-party plug-in from Main 
Event Software < http://www r .mainevemxoni/ > T With the 
release of Photoshop 7, although Photoshop now supported 
AppleScript, this support was not installed by default. Rather, 
users were required to run a second installer from Adobe, in 
order to add scripting support Since that time, Photoshop’s 
scripting support has continued to grow with each new release, 
as the application implements new features and options. Today, 
Photoshop's scripting support is installed automatically, and has 
become a vital part of countless users' automated workflows* 

Before we get stalled with writing code, 1 should mention 
that all of the examples in this month’s column were written and 
tested with Photoshop CS2, version 9.0. If you are using a 
different version of Photoshop, please be aware [hat certain 
terminology may differ from that which l am using. In order to 
ensure dial you are using the proper terminology, be sure to 
consult Photoshop’s AppleScript dictionary. 

Benefits of Scripting Photoshop 

Regular Photoshop users often question the need for using 
AppleScript to drive Photoshop, since many automation 
technologies are actually built into the application itself. 
Photoshop’s built-in actions palette will allow users to record 
manual tasks, to l>e triggered later at a click of the mouse in order 


to automate time-consuming and repetitive processes. Photoshop 
even contains a batch capability, wliich can allow users to 
automatically process complete folders hill of files at once. 

Yet, AppleScript automation of Photoshop lias many 
benefits. For one, Photoshop actions don't contain logic, i.e. if 
this situation occurs, then do this one thing, if this other situation 
occurs, then do this other thing. AppleScripts, on the other hand, 
can be written to analyze situations, and take different courses of 
action based on situations that are encountered during 
processing. Furthermore, an AppleScript can be written to 
trigger Photoshop actions, making it possible to utilize a 
combination of AppleScript and built-in recorded actions in order 
to achieve more complex types of automation. Another thing 
that AppleScript can do, wliich Photoshop's built-in automation 
cannot do, is interact with oilier applications on your machine* 
AppleScripts, for example, can be written to do things such as go 
into QuarkXPress, extract a list of images, open those images in 
Photoshop, process them, and import them into Quark again. 

As you can see, there are a number of benefits to using 
AppleScript to drive Photoshop. Now, let’s start w r riling some code* 

Getting Started 

Opening Images 

When scripting Photoshop, one of the first tilings that you 
will probably want to do is open an image. This can be done 
by using the open command. For example: 

set the Image to choose file with prompt ■‘Please select an 
image file; ” 

tell application "Adobe Photoshop CS2" 
open thelmage 
end tell 

When opening images in Photoshop via AppleScript, one 
tiling to keep in mind is that in certain circumstances, dialogs 
may be displayed, requesting user input. Figure 1 shows an 
example of a dialog that could be displayed wTien attempting to 
open an EPS File, 

Rasterize Generic EPS Format 



Figure 1. A Photoshop Open Dialog Window 

If a dialog is displayed in Photoshop when attempting to 
open an image with AppleScript, this am actually cause your 
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script to hang, as it will lx.* waiting for a reply from Photoshop 
indicating that the document was successfully opened. With a 
dialog opened in Photoshop, this reply will never come, and 
your script will eventually time out. To try to ensure that thus 
type of situation does not occur, it is usually a good Idea to 
utilize the showing dialogs parameter of the open command* 
Tiih parameter may lx? used to prevent dialogs from being 
displayed when opening a file. For example: 

tell application "Adobe Photoshop CS2“ 
open theImage showing dialogs never 
end tell 

Although they may appear when opening problematic files, 
dialogs are usually displayed during the open process when 
attempting to open certain types of files, sucli as EPS files, as we 
have seen above, PDF files, or Camera RAW' files. The reason 
for this is because Photoshop will allow you to specify various 
options for how the 
file is handled as it is 
opened. Suppose 
you want to open a 
multi-page PDF, for 
example. To do so, 
you would need to 
indicate to 

Photoshop which 
page of the PDF to 
display* You may 
want to specify other 
options as well, such 
as resolution, 

just as in 
manual processing, 
when w r riting a script 
that will open a file, 
you may not always 
want to bypass open 
options for certain 
types of files* Rather, 
you may want to 
specify the options 
that should be used* 

To do this, you may 
use the with 
options parameter 
of the open command, and specify the open options for the 
type of file being opened. A list of scriptable open options can 
lx* found in the Open Formats Suite of Photoshop's AppleScript 
dictionary. See figure 2. 

The following example code demonstrates the proper usage 
of the open command, while specifying options for opening an 
EPS file* 

set ihtflmagt* to chooue file with prompt ''Please select an EPS 
filer 

tell application "Adobe Photoshop CS2" 

open thelmage with options I cl ass:EPS open options, 


constrain proportions:false* use antiaiias:false. node*RGB, 
resolution: MO I shoving dialogs never 
end tell 

Modifying Application Settings 

Before we l^egin working with opened images in Photoshop, J 
want to mention that many of Photoshop's preferences are 
accessible with AppleScript* These settings are accessible via the 
settings property of PIk xosl u> p’s application class. 

One such modifiable setting is Photoshop's uniL of 
measurement, i.e. pixels, inches, centimeters, etc. You cannot 
assume that the user running your script is using the same units of 
measurement that you are. Since many scriptable image 
manipulation techniques in Photoshop require that you provide 
unit values, it is necessary to ensure that the correct unit type is 
lieing used. For example, suppose you Itave written a script that 
will resize an Image to 800 x 600 pixels* If Photoshop's units of 
measurement were set to inches, you would end up with one 

extremely large 
resized image* 

The following 
example code 

demonstrates how 
you could go about 
changing Photoshop's 
units of measurement 
to the type required 
by your script, in this 
case, pixels* 

tell application 
“Adobe Photoshop 
CS2" 

set ruler units of 
settings to pixel 
units 
end tell 

Working 
with 
Images 

Now that you 
know how to open 
an image in 
Photoshop, you will 
likely want to begin 
processing it. To do 
so, you will need to reference the image in some way. This Is 
done via the document class* Unfortunately, Photoshop 
doesn't subscribe to the common front to back numeric ordering 
scheme that most applications do. In other words, as you will 
find, document 1 will not always lie the front document* 
Because of this, you will probably want to refer to a document 
by name* For example: 

tell application "Adobe Photoshop CS2* 
tell document "My Document.ops" 

- Do something 
end tell 
end tell 


0 0 0 & Adobe Photoshop CS2_ CJ 
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Figure 2. PDF Open Options 
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That said, if you only have one document opened, then it 
is safe to refer to the document numerically. For example: 


To retrieve the resolution of a document, you may access its 
resolution property, as shown in the example code below 


tell application “Adobe Photoshop CS2” 
tell document 1 
“ Do something 
end tell 
end tell 

Accessing the Current Image Document 

Hie open command in Photoshop does not produce a 
result, such as a reference to the newly opened document 
Therefore, after opening a document, you will probably want to 
retain a reference to it. Assuming that the newly opened 
document is the front document, which it should you can 
retrieve a reference to it by accessing the current document 
property of the appl i.cat i on class. For example: 

tell application "Adobe Photoshop CS2" 
set theDocument to current document 
end tell 

-> document "My Document,eps" of application "Adobe Photoshop 

csr 

Accessing Image Document Properties 

In Photoshop, documents possess a wide variety of 
properties, many of which are read only. Regardless, 
utilizing document properties is an important part of 
scripting. For example, you might want to retrieve the 
height, wklili, and resolution of a document, in order to 
determine whether the document needs to be resized, 
cropped, or otherwise, 

The following example code demonstrates how to 
retrieve the height of a document. Notice that its result is 
returned using the current unit of measurement, which, in this 
case, is pixels, 

tell application "Adobe Photoshop CS2" 
tell theDocument 
height 
end tell 
end tell 
-> 3300.n 


To retrieve the width of a document, access its width 
property. For example; 

tell application "Adobe Photoshop CS2 H 
tell theftp.£ujnent 
wtdi h 
end tell 
end tell 
-> 2550.0 


It is also possible to dynamically convert unit of 
measurement values to the desired type. For example, the 
following code will retrieve the width of a document, in inches, 
regardless of Photoshop's current units of measurement setting. 

tell application "Adobe Photoshop C$2 M 
tell theDoeminent 
width as inches 
end tell 
end tell 
-> 8,5 


tell application "Adobe Photoshop C32" 
tell theDocument 
resolution 
end. tell 
end tell 
> 300.0 


We have just scratched the surface regarding dealing with 
document properties. Documents possess many other 
properties, which l encourage you to explore further in 
Photoshop's AppleScript dictionary. 

Accessing File Info 

In Photoshop, documents may also possess whai is known 
as file information. This information, once applied, will stay 
with many types of files, once saved, and may be extracted or 
displayed by other applications. File information could be a 
document author, copyright information, a description, etc. 

A documents file information may lx? modified via AppleScript. 
This is done with the use of the info property of the document 
class. The following example axle will apply an author name, URL, 
and copyright information to the file information of a document 

tell application "Adobe Photoshop C$2" 
tell theDocument 
tell info 

set author to “Ben Waldie" 

sat owner url to “http: //www. automat ed work flows. corn" 
set copyrighted to copyrighted work 
set copyright notice to "Copyright 2006, Ben Waldie, 
Automated Workflows. LLC" 
end tell 
end tell 
end tell 


In Photoshop, file informal ion fora document may be viewed 
by selecting File info... from the File menu, Figure 3 shows an 
example of the file information window for ;i document 



Figure 3. File Info for a Document 
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It is also possible to retrieve the file information of a 
document via AppleScript. The following code demonstrates how 
to retrieve the author of a document from its file information. 

tell application “Adobe Photoshop CS2" 
tell theDo ament 
author of info 
end. tell 
end tell 
-> "Ben Val-dle* 

Manipulating Images 

Most Photoshop scripters will not simply want to access 
document properties and file information, leather, they will want 
to get started with manipulating images, Photoshop’s 
AppleScript dictionary contains numerous commands Tor 
performing various types of image manipulations. Well explore 
a few of these now. 

Resizing Image Documents 

Tile resize command, which can be found in the 
Photoshop Suite of Photoshop’s dictionary, may be used to 
change the height, width, and resolution of a document This 
command is utilized in the following manner: 

Tell application "Adobe Photoshop C52” 
tell theDocument 

resize image width 600 height 776 resolution 150 
resample method bicubic 
end tell 
end tell 

Rotating Image Documents 

To rotate the entire document, you may use the rotate 
canvas command, which Ls also found in the Photoshop Suite of 
Phoioshops dictionary. For fills command, simply specify the 
angle that you want the document to lie rotated. For example, the 
following code would rotate the document 90 degrees clockwise. 
You may specify a negative value to rotate counterclockwise, 

tell application "Adobe Photoshop CS2 M 
tell theDocument 

rotate canvas angle 90 
end tell 
end tell 

Alternatively, the rotate command may be used to rotate 
a specified layer, rather than the enLire document. 

Applying Filters 

Another image manipulation lhat can be performed in 
Photoshop using AppleScript is the process of applying a filler 
to a document. This is done using the filter command, 
specifying a layer on which to apply the filter, and indicating the 
filler you wish to apply. For example: 

tell application “Adobe Photoshop CS2" 
tell theDocument 

filter layer 1 using blur 
end tell 
end tell 


There are dozens of filters available, which can be applied 
to images via AppleScript. A list of scriptable filters can be 
found in the Filler Suite of Photoshop's dictionary. One thing 
to be aware of when scripting filter application, is lhat many 
filters require that you specify options for the filter, in order to 
apply ii. The unsharp mask filter Is a good example. In 
order to apply this filter, you must specify values for die filter's 
radius, amount, and threshold options. 

To specify options for a filter when applying it, use the with 
options parameter w id i Ll ic filter command. For example: 

tell application “Adobe Photoshop CS2 M 
tell theDocument 

filter layer 1 using unsharp mask with options 
(amount;50, radiustl, threshold:0[ 
end tell 
end tell 

When using filters, lie aware that many filters will require 
that options he specified. To determine if a filter has required 
options, locale and view the class for the desired filter in 
Photoshop's dictionary. 

Outputting Images 

Now that we have discussed opening and manipulating 
images, let's talk briefly about outputting the images that our 
script may have just modified. 

Saving Image Documents 

In Photoshop, documents may i>e saved in a variety of 
formats, including EPS, GIF, JPEG, and TIFF, among others. To 
simply save a document in its current format, simply use the 
save command by itself, as follows. 

tell application “Adobe Photoshop CS2" 
tell LheOucument 
save 

end tell 
end tell 

-> document "My Document,eps“ of application “Adobe 
Photoshop CS2" 

To save a document into a new location, utilize I he in 
parameter of the save command, and provide an output file 
path. When doing this, you will also want to specify the type 
of file that is saved. This is done via ihe as parameter of the 
save command 

tell application “Adobe Photoshop CS2" 
tell tbeDocument 

save in “Macintosh HD;J$cetS:hwaidie;Desktop:% 

Document. + jpg“ as JPEG 
end tell 
end tell 

-> document "My Dgcument.jpg" of application "Adobe 
Photoshop CS2“ 

The above example will save the document in JPEG format, 
using the default JPEG save options. When saving any type of file 
out of Photoshop, it is also possible to specify the save options that 
are used 'The save options for each output file type can lie found 
in the Setve Formats Suite of Photoshop’s dictionary. See figure 4. 
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embed color profile in document 
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halftone screen (boolean) : 

include halftone screen ( default: false ) 



Figure 4. Photoshop's Save Formats 


To specify save options when saving 
an image, use the with options 
parameter of the save command. For 
example, the following sample code 
demonstrates how to save a document as a 
JPEG, using certain specified settings. 

tell application "Adobe Photoshop CS2" 
tell t heDgc union t 
save in “Macintosh 

HD: Users: bwaIdle : Desktop: My Document * jpg" 
as JPEG vith options 1 class:JPEG save 
options , quality: 12. ( format 
options;optimized \ 
end tell 
end tell 

y document "My Bocument.jpg* of 
application “Adobe Photoshop CS2” 

Exporting Images for the 
Web 

Another method of saving a document 
is to make use of Photoshop's Save for Web 
technology. Kather than using the save 
command, however, ihis process is done 
via die export command. In doing so, 
you may specify the Save for Web options 
to be used during the export. The 
complete set of Save For Web options can 
be found in the Export Formats Suite of 
Photoshop's dictionary. See figure 5. 
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Figure 5. Photoshop's Save For Web Export Options 


photoshop/sdk/index scriptintr.hrm 1>. These 
documents will guide you through Photoshop’s 
scripting support, and include example code and 
detailed information about Photoshop's AppleScript 
classes and commands. 


In Closing 

l hope that you now have a good idea of what 
is possible when it comes to scripting Photoshop. 
If you take some time to review Photoshop’s 
dictionary in detail, you wall find that there are 
plenty of other features that are accessible through 
scripting. If you use Photoshop in your daily 
routines* then you are more than likely 
encountering your fair share of time consuming 
and repetitive tasks. Sure, in some cases, you may 
be able to record a simple action to automate 
those processes. However, next time, i would 
encourage you to expand your horizons and try 
writing an AppleScript to do it instead. 

Until next time, keep scripting! 

CM 


The following example code will save an image in JPEG 
format via Photoshop’s Save For Web technology, using 
specified export options. Due to a compilation issue with the 
as property of the save for web options class, in order 
to specify a file format when exporting in this format, a tricky 
workaround is necessary. Thanks to Nigel Garvey’s insightful 
MacScripter.net AppleScript BBS <http://bbs,applescripl.net> 
post for this great workaround! 

tell application “Adobe Photoshop G52" 

sot theFormat to run script “tell application \"Photoshop 
to return Uclass fltp*:JPECl" 

set theExportOptions to (class:save For web export options, 
interlaceditrue, quality:3D] & theFormat 
tell theDocument 

export in “Macintosh 

HD:Usersrbwaldie:Deski op:My_Document.jp&" 0 3 save for web 
with options iheExpor tGptioiis 
end tell 
end tell 

Resources for Continued Learning 

If you are serious about getting started with scripting 
Photoshop, there are some resources that can help you to 
proceed* First, perhaps one of the most valuable resources 
available is the Photoshop scripting forum at the Adobe user-to- 
user forums. This forum, along with several other forums for 
scripting (and using) Adobe applications, can be found at 
< h Up:/ /w w w. ad obc ibm m s „ eom/> . 

Some other great resources for Photoshop scripters are die 
Photoshop CS2 AppleScript Reference Guide and the Photoshop 
CS2 Scripting Guide, both of which can lx: found on the Adobe 
website at < http ://partners.adobe, com/pub iic/developer/ 
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Technology Guide to Aotomator", available from 
<http://www.spiderworks.com>. Ben is also 
president of Automated Workflows, LIC, a 
company specializing in AppleScript and workflow 
wtomation consulting. For years, Ben has 
developed professional AppleScript-based solutions for businesses mdodhtg 
Adobe, Apple, NASA PC World, and TV Guide. For more information about 
Ben, please visit <ht1p://www.automatedworkflows.com>, or email Ben 
at <ben@automatedworkfhws.com>. 



Magazine 

Get MacTech delivered to 
your door at a price FAR 
BELOW the newstand price. 
And, it's RISK FREE! 






16 August* 2006 


VWW.MACTSCH.COM 






































No Limits 


Home Entertainment Center 


Premier External 
\ Storage Solution 

,, USB/FireWire Port 
Expansion Hub 


Total Portability 


Up to 
750GB! 


(Maximize your 


.On the Job 


Complements All Computers 


miniStack V2 


com/storage 

Stack* V2 now 


500MB Copy Test' 


The NewerTech 
with both rear and side FireWire and 
USB Hub ports. Now up to 750GB! 

Home Entertainment, Audio/Video, 
Backup, Bootable Data Storage, Music, 
Graphics, Performance RAID; & More! 


SttKfc Drive \ 
44&7$rtontii 1 


Extra y 
Ports !*3 


Other WorlO Computing 

Serving the Computer Universe since 198$ 

Visit macsalesxom/storage 800.275,4576 


Check out our full line of '' 
external storage solutions 
plus much more at \ 

«T_0M* World Ca«jpulto*. Htswltthnirtctf, *jwn for* IWiSfctOtM. ft 6tHm 

spedAntlom,AndwtUftMII'yArtwbfwttowithinlod4VJm*yhciu^T^4fni«fe»ni,(«. h*m*pxvi without^unmMHch»(iis»ltuth«rl»tiMnwmtur. 


ww.MacSales.com 


Storage Capacities from 80GB to 750GB. 







































To Tune, or Not to Tune 

That is the Question 



By Steve Modica 



Welcome 

One of the things I love- alxxit using a Mac is the way Apple 
supports their customers. Apple provides software and hardware to 
support the vast majority of their customers' needs. Their updates 
are reliable and simple, so that customers move to them quickly. As 
a result, 1 am typing this article on a system that is similar to 99% of 
all other Apple systems. II there Is a bug lying in wait for me, 
chances are, someone else has discovered it, and the bug is fixed 
before I discover it. There us a lot to lx* said lor strength in number 

Having spent many years supporting high performance 
computing customers, 1 have debugged many calls from 
customers who were quite sure they were not getting the lx*st 
performance from their computers. In some cases; they were 
right! In most cases there were other factors that had nothing to 
do with system tuning. However, there is always this notion that 
some “wizard” can come along and wave his magic tuning wand, 
and for no additional investment, make your system go faster! 

Sorting it Out 

If you are a car mechanic certainly, no one would tell you 
how to fix your ear. There are experts who choose Lo change 
spark plug brands between summers and winters because they 
can detect a performance difference, Experts like these, also 
have the Lime, equipment, and experience to fix mistakes when 
they accidentally knock a hose off their engine while fx>kmg 
around, fd like to refer to this as, "cars as a hobby." This is noi 
about a need for a better-tuned car or a return on investment. 1l 
is about having fun working on your cur and achieving 
perfection. These people are honing their art. 

Like most PowurBooks, mine is a workhorse. It handles 
personal and business finances, email, web browsing, and various 
applications, 'Ihere are gigabytes of data on there that are extremely 
important to my family, my business, and me, I don’t believe my 
PowerBook Is doing anything different from what Apple intended, 
nor do 1 need to tune it. There might be a 5% performance 
improvement somewhere if i tweak something here or there, but 
then my PowerBook is no longer like 99% of the other PowerBooks. 
But now, alter making performance optimizations, my increased 
network performance or maximized disk performance puts me right 
at the from of the list for finding a hidden bug. 

So when should you tune? 

First, trying to tune a system that does not have the 
resources it requires to do the assigned job is like trying to tune 


a cheaply made guitar. If you are serious about getting 
work done, get a well-made guitar. Second, if the system's 
usage pattern is typical, do not tune your system. You are 
better off taking advantage of all die similarly configured 
systems doing the same thing that are tuned the same way. 
But if your system is being asked to do something special, 
like serving only realty large video files, then perhaps 
tuning is something you may want ro consider. 

If you call the system your ''mail server* or your “file 
server,” then there is a good chance your system is doing a 
specific task much more often than a typical system. This is 
when you may find some benefit in tailoring the system 
configuration settings lo that specific task. 

Physical bottlenecks 

Let's stan by considering a fiieserver. Assuming your 
Xserve or Tepurposed" PowerMac is not quite making the 
grade as your fileserver. The first question you have to 
answer is: 

Is tills System Capable of Delivering the 
Performance I Need? 

'the best way u> find this out is to first understand what 
your traffic kxiks like, and then break the problem down 
into easily measurable elements. Files must lie read from 
disk into memory; memory must lx turned into mbuf s and 
routed onto the network. Depending on what client 
systems are doing, clients may need to pull data into 
memory and then store it to their local disk drives. 

Your fileserver must have several resources to operate 
efficiently. Perhaps the most important resource is memory. 
Users tend to read the same data over and over again. 
Operating systems have long since taken this into account 
wilh the use of a buffer cache. A buffer cache is an area, 
set aside in memory, to store information temporarily. This 
is done so that the CPU can perform other tasks while the 
10 device fills up the buffer cache The most recently read 
data is saved in memory so that it can be accessed quickly, 
without issuing a redundant read operation to the disk. 
Similarly, it is often the case that when we read the first 
hyte of a file that we will continue to read many more 
bytes. Operating systems take this into account and 
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perform read-ahead operations. This enables the operating 
system to have the data you need in memory even before you 
have requested it. 

Assuming your system Ls equipped with ample resources; it 
Ls easy to isolate the physical limitations of the individual devices. 
For example, if you have 10 client systems retrieving data from a 
Hie server, and each client is achieving 90Mb/sec t then your 
aggregate network bandwidth is900Mb/sec. Ihis is the maximum 
bandwidth of a single Gigabit port. That is a very reasonable 
limitation. It follows then, that if you want letter lO performance 
for your clients, you simply need to add additional Gigabit ports, 
and allocate these resources appropriately for each client. You 
may also see ihai your CPUs are at 100% utilization, or that your 
disk bandwidth is at its theoretical maximum throughput 

if you find that the system performs well at certain loads (1- 
3 clients), but begins to degrade drastically below its physical 
maximums as you add clients, then consider adding memory so 
that the operating system has more buffer cache to work with. 
It is very likely that you simply do not have enough memory, so 
dial each client access requires a direct disk lO operation. If 
there Ls nor enough memory for buffer cache or not enough 
memory for the operating system perform read-ahead 
operations, then disk IO operations become very inefficient. 

One way to check how much memory is available for things 
like the Buffer Cache is to look at the Activity Monitor 
(Applications -> Utilities -> Activity Monitor), This utility allows 
the user to examine a number of system resources including 
CPU, memory and disk bandwidth. Looking at the System 
Memory pane, one can see how much memory the system is 
using. “Inactive" memory is memory that has been written out to 
disk, but is being kept around in case users attempt to access it 
again. Consider how much data each of your users is accessing 
and reusing continuously during an edit session. If a typical user 
is operating on 8GByte hies and you have a few hundred 
MBytes of cached disk data, you probably do not have enough 
cache. Each time your users move around within their project, 
they are forcing the system to go back to disk, which creates a 
large number of inefficient IOs. Simply adding a few Gigabytes 
of memory will help performance immensely. 

Why is it Sometimes Necessary To Tune 
Your Network? 

Wouldn’t it be great if somebody wrote a utility that 
analyzes your network and automatically selects the optimum 
settings? They already have! IPs called TCP/IF, but occasionally 
it requires some attention. In most cases, TCP works remarkably 
well all by itself. Tuning is needed in cases where TCP is not 
optimized l>ecause the network behavior is not normal. 

TCP/IP is not controlled by any manufacturer and is 
designed to work on almost any kind of underlying network 
with widely varying characteristics. To meet this challenge, the 
protocol designers made TCP adaptive. TCP is self monitoring 
and optimizes its own behavior to match the network 
environment. Adaptation takes time and die default settings 
cannot lie optimized for every possible kind of network. 


There are also many independent implementations, and 
the protocols continue to evolve in response to practical 
experience, and some implementations have peculiar 
compatibility constraints. 

Typical network abnormalities are: 

* Asymmetric connections. These are connections that are 
much faster downstream, than upstream. 

* High performance connections with relatively long latency 
(measured in bytes) such as fiber optic, satellite, or point-to- 
point protocol (PPF) over a cellular network. 

* Point-to-point Protocol over Ethernet (PPPoE) 
implementations that restrict the maximum transmission unit 
(MTU) on the network without support for Path MTU 
Discovery or fragmentation. 

* Heavily congested links. Tuning cannot solve everything. 
You may need to restructure your network or use packet 
shaping to control traffic flows. 


Tlie key to optimization in such cases is to measure, adjust, 
and repeat. Notice that it's not necessary to find the perfect 
settings, only to get close enough that TCP works efficiently in 
your environment. The tools included with IPNetTunerX from 
Sustainable Softworks are designed to make this easy and show 
how well TCP is actually working, (Refer to hiip://sustworks.com 
for more information.) Keep it simple. IPNetTunerX offers a 
collection of presets to solve the most common tuning problems 
for users with asymmetric broadband connections. 

The follow screen shot shows the Basic panel from 
IPNetTunerX. The Basic panel enables you to select presets Lhat 
tune certain activities like connecting a Bluetcxnh phone or just 
browsing the internet. 

Oh O Untitled 


Basic Advanced 


Timer Preset: Download* Browse 


A Tuner Preset is a collection of parameter settings designed tor 
common network configurations To begin using IPNetTunerX. 
select a Preset, press Apply, and then use the tools under the Tool 
menu to see if performance has improved. You can save your 
sellings as a document and restore them again later by opening it 

if you select 'Quit after restoring settings' below and then save 
your sewings, launching this document will restore your settings 
and then qun automatically. K you make this documeni a “Login 
Hem" in the Accounts Preferences oanei, IPNetTunerX wtll restore 


_ Quit after restoring settings 


d> 


Load Defaults 


Apply 
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Figure 1, IPNetTUnerX Basic Panel 
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TTie following screen shot shows the Advanced panel. The 
Advanced panel enables you to tunc individual parameters like 
the TCP send and receive space, 

O O © Untitled __ _ 

Basic Advanced -* 
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Default 3276S 


? OK 


Load Defaults Apply 


Figure 2. IPNetTUnerX Advanced Panel 
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What if / have more than one kind of network connection , 
like wireless internet served through a satellite? Which one 
should f tune for ? 

Just as a chain is only as strong as its weakest link, you want 
to tune your connection to improve performance over the 
weakest link or bottleneck. If the connection is highly 
asymmetrical, has an MTIJ restriction, high latency, or some 
other problem, you make adjustments to compensate. ITie term 
tuning is misleading in this case because ii suggests that you 
make adjustments Lo find tJie optimaJ setting. A "bottleneck 
bypass’* Is a better description. Getting around a bottleneck 
might reduce performance slightly in another area, buL this 
usually isn’t a problem. 

Can I tune TCP differently for my Ethernet IAN versus 
Internet connection if they use different network ports? 

TCP sits above the IP network layer so doesn’t normally 
know flow the underlying data is routed. 

Can l tune TCP at my muter or do / need to tune TCP at 
each host on my IAN? 

TCP is end-to-end, so it generally makes sense to tune TCP 
at one or both ends of the connection. Some devices offer a 
packet shaping feature thai enables you to adjust TCP traffic 
flows to reduce congestion. Another possibility is to use a proxy 
server so that external connections originate from a different 
host. Depending on the problem, these might lx. 1 appropriate but 
are generally more involved. 
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About The Author 

Steve Modica is CIO of Small Tree Communications, leading designer and 
manufacturer of high-performance network products for Mac OS X. 
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MlndManager 6 
for Mac 
by Minrijet 

You have ideas, 90a Is. options Mow can you bo 
sure to cover hie small details and see the big 
picture- and do it fast? Simple: visual thinking. 
Mmdjet MindManager fi frees you to brainstorm 
around a central concept as you identify relevant 
issues and their relationships using visually 
intuitive rich-data maps 


www.programmers.com/ mlndfel 


Intel* C++ Compiler Professional 
Edition for Mac 

by Intel 

The told Ch Compiler Profcsstona! Edition for 
Mac OS demunslrate Inters commifrnent to 
Macintosh duvtrlupijrs, StatHufthe-art features 
and usability take fell advantage of next- 
genemtion Mac hardware The Rmfessinnal 
Edition enables even greater perfwmanre hy 
handling 

in the highly optimirod function libraries Intel" 
Integrated Pferforinonoe FVirmlives {Inter IPF| 
and [iituT Mulli Kernel Library (in tuf MKL}. 


www.programmer5.cnm/ lute) 


I Retrospect for Mac 
; Workgroup Edition 
j by EMC 

[ Retrospect is. the #1 business backup software 
[ for Macintoshes Retrospect Workgroup Edition 
; protect Lfra sarvur it is installed on and 20 
I networked Macintosh, Windows, or Red Hat Linux 
i desktops uud uulubeob Retrospect 6 .1 surpasses 
; the terabyte I imi t when protecting Xserve servers 
I and Xsoive RAIQs, and supports advanced SCSI and Fibre Channel 
: tape library features including import/export slots, barcode inventory, 

[ cleaning tapes, and more than m tape stats. 
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D64 0189 
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: Adobe Creative Suite 2 
; Premium for Mac 
by Adobe Systems 

j Adobe Croat 1 vu Suite 2 is a unified design 
l environment drat delivers the next level of 
) Integra bon in creative software New features 
j and tighter integration among suits 
| components simplify creative and production 
I tasks, enabling you to work more efficiently 
] than ever before. Adobe Creative Suite 2 
j enables you to realize your ideas anywhere— 
j in print on the Weti r 0 1 um mobile devices. 

j Paradise if 
| A1412RZ 

; * 1191 .” www, programmers, com/adob* 
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QuarkXPress 7 
for Mac 
by Quark 

QuutkXPress is powerful design and 
page layout software with an intuitive, 
versatile interface that lets you combine 
superior typography with color and 
pictures to produce dynamic final 
output for print and Web delivery 
QuarkXPress is widely used by 
maplines, nuwsppurs. advertising 
agencies and design firms, marketers, 
printers, corporate publishers, catalog 
houses, and book publishers. 


www.progranimers.coni/quark 
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FlightCheck Professional 5,8 
for Mac 
by Markzware 

Fli^itCheck Prulessional is the essential quality 
control tool for any and all parhripams in the print 
and rich media markets, from creative designers to 
manufacturing professionals and organizations 
Thts multi-award winning prepress solution sets 
the standard for prcllrghting This advanced, stand 
atone application lias saved die printing industry 
millions d dollars in reprucessing costs. Now with 
QuarkXPress 6.D, Adobe InDesign CS r Illustrator CS 
and Microsoft Word 9 file supporti 


www. programme rs. com/ m arkzware 


Adobe Macromedia Studio 8 

by Adobe Systems 

Studio B is the essential software suite used to 
design, develop and maintain interactive online 
experiences W Eh the latest releases of 
Dreamweaver, Hash Professional, Fireworks, 
Contribute and RashPaper, Studio B offers web 
designers and developers a new level of 
expressiveness, efficiency and simplified 
workflow to create websites, interactive 
experiences arid mobile contenL 


Eye Candy 5 
: Bundle 
| by Alien Skin 

j The Alien Skin Eye Candy 5 : Bundle offers 
! three complete products frir one low price 
j The bundle includes fuff, retail copies of Eye 
j Candy S Textures: Eye Candy h Nature: and 
j Eye Candy S: Impact. That's 30 ol die most 
! advanced special el loots for one low price. 
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Intel* Fortran Compiler 
Professional Edition for Mao OS 
by Intel 

I he Intel Fortran Compiler Professional Edition 
for Mac OS provide a fast and easy way to 
increase performance for compute-intensive 
applications Fortran developers can benefit 
from this hardware advantage today Intel 
Fortran Compiler Professional Edition for Mat 
OS deliver 5 further value by including the highly 
optimised, thread-safe Intel Math Kernel Library 
(Intel MKU. 




Adobe Photoshop CS2 
by Adobe Systems 

Adobe Photoshop CS 2 software, the 
professional image-editing standard and 
leader of the Photoshop digital imaging 
line, delivers more of whar you crave. 
Groundbreaking creative toots help 
you achieve extraordinary results. 
Unprucettoniud adaptability \m you 
custom-lit PlKJioshup to die way you 
work. And with more eff ictent editing, 
processing, and fife handling, there's no 
slowing you down 
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MICROSOFT | MAC IN THE ENTERPRISE 


Windows SharePoint 
Services (version 3) on 

the Mac 


By Brian Johnson 


Welcome 

In my last article, l discussed how Mac users could make the 
most of Windows SharePoint Services (version 2). In tills article, 
Ill tell you about the next version of Windows SharePoint 
Services (version 3) now available in IxTu, and how you can use 
this new version effectively from the Mac. 

What’s New? 

There are a lot of new features in Windows SharePoint 
tervices v3. The first thing that most Mac users will notice is an 
updated user interface that renders much (letter on the Mac in 
Ixjth Firefox and Safari* The new templates render well and 
you'll notice better performance when you are customizing 
your sites and pages from the Mac. Figure 1 shows a Windows 
SharePoint v3 site in Edit Mode in Firefox. 





Figure 1. SharePoint v3 site rendered in Firefox on the Mac 


Windows SharePoint Services v,3 ships with 6 standard site 
templates* These templates include some of the site types your 
familiar with from v2, plus a could of new ones: 

• Document Workspace 

■ Team Site 

• Blog 

• Wiki 

• Meeting Workspace 

• Blank Site 

The two mast commonly used templates are probably the 
Document Workspace and the Team Site. 

A Document Workspace essentially acts as a very smart 
folder, which supports collaboration on one or more shared 
documents and supporting files. The Document Library folder 
supports check in/checkout and versioning and the site features 
a Task List and a Links list that a group can use to'track 
assignments and progress on the document. 

A Team Site is veiy similar to a Document Workspace, but 
the scope is usually wider, serving the needs of a larger group 
of individuals. Team SiLes feature a Document Library, an 
Announcements List, a Calendar, Contacts and a Quick Links list 
by default. 

The Biog site is a new feature in Windows SharePoint 
Services v3< A blog is simply a lust of stories posted with the 
latest item at the top of the list, litis makes it easer for readers 
to scan a list they've seen for the latest news from the blog. The 
Blog site in SharePoint v3 also features an RSS feed and the 
ability for others to comment on blog posts. This ability to 
comment on posted items allows for the exchange of ideas 
between the author of the blog and the readers and even 
between the readers themselves. You can see an example of 
how the SharePoint v3 Blog site looks in Figure 2. 
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Convert your PowerBook or iBook to a desktop system in 
seconds without misplacing cables or damaging connectors 


Eliminates cable confusion and damage to connectors. 
New release levers for easier docking and undocking. 
Adds only 3” to rear when docked. 

Also available for G3 PowerBooks. 


iBookEndz 
Docking Station 


New Higher Resolution 
Ga 15’'- 17” PowerBook 
Docking Station 


12” Ga PowerBook New Higher Resolution Docking Station 



Aluminum look to match your PowerBook. 

Eliminates cable confusion and damage to connectors. 
All connectors are routed to the rear of the Dock. 

The Dock converts RGB to standard VGA connector. 
Streamlined design complements your PowerBook. 

Use internal or external speakers. 

Easy to use ejection system. 


Check our Web Site for latest product announcements 

© BookEndz - Manufactured by OlympicControls Corp. 

1250 Crispin Drive, Elgin, Illinois 60123 
Phone: 888-022-1199 • Fax: 847-742-5680 • www.bookendzdocks.com 


www.bookendzdocks.com 
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Figure 2. A Blog site in SharePoint v3. 



AScreenSavrz" 

for all iWlacf and Apple* 3 cinema displays 

- Super thin F ultra-tough Optex^material 

* Shields against oils, dirt and abrasions 

* Covers, deans, polishes and restores 

10% off your order with Promo CodeMT86Q expire lo/an/os 


Another new .site template m 
SharePoim v3 is the Wiki site. A wiki is 
a site that allows any authorized user to 
edit a page quickly and easily. One of 
the features of the wiki that make it a 
powerful tool for collaboration is the 
ability to instantly create a new page 
based on a term in the current page. 
Adding double brackets around a word 
in a paragraph creates a hotlink to a 
new page in the wiki. Wikis work well 
as sites where group knowledge is 
stored and retrieved. Par example, you 
can use a wiki to store information 
about configuring machines on the 
network. As the information around 
that topic changes, admins and users 
can update the data on die pages of the 
wiki so that die information is always 
up-to-date. Wikis can also be used for 
brainstorming, research, and for 
planning. Individuals and groups can 
use a wiki to store meeting notes and 
other textual information dm needs to 
I m updated on a regular basis, 
SharePoint v3 wiki pages work well on 
both the PC and the Mac, but only the 
PC version running in Internet Explorer 
features a WYSIWYG editor. Users 
writing to a SharePoint wiki on the Mac 
will need to use simple HTML markup for Formatting and linking. 

A Meeting Workspace is a site used to track meeting notes 
and schedules. At launch SharePoint v3 is scheduled to provide 
5 different workspace types. 

Finally, the Blank Space is just that, it’s blank. This means 
that you am start a site with just the content you want. 

New Content 

The version 3 SharePoint sites features an updated Create 
Page where you can add many of the features lVe mentioned 
already to an existing site. This means you can add additional 
Document Libraries, Wiki pages, tracking calendars, and even 
sub-sites to an existing SharePoim site. 

The content page types that can be added to a SharePoim 
v3 site are broken into 5 categories; Libraries, Communications, 
Tracking, Customer Lists, and Web Pages. 

Library types include the Document Library, the Form 
Library, the Wiki Page Library and the Picture Library. The only 
library type that might prove difficult for Mac users to use is the 
Form Library. Form Libraries depend on features found in 
Microsoft InfoPath, which isn't available on the Mac. The other 
library types should work fine, except in cases where 
functionality is dependent on an ActiveX control, for example, 
when you want to export a list to a spreadsheet 
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Communications page types include Announcements, 
Contacts, and Discussion Boards, Of these, the Discussion 
Boards feature is interesting in that the boards created in 
SharePoint v3 have die look and fed of modern web discussion 
boards and the interface is easy to use from the Mac. 

The Tracking page types include Links, Calendars, Tasks, Issue 
Tracking and Survey pages. One of the most exciting new features 
of SharePoint version 3 is the Project Tasks tracking page type. Ibis 
new page type provides 
a Gantt Chart view that 
allows you to instantly 
see the status of items in 
a project lust. Hits is a 
great feature for users 
managing small projects 
and it works well on the 
Mac, Figure 3 shows the 
new' Project Tasks page 
with a few items added. 

In the Custom List 
category, the Custom List 
view is die only one that 
works well on the Mac. 

The Custom List in 
Datasheet View selection 
will work, but you don’t 
gel a datasheet, you get 
a simple custom list. The 


Import Spreadsheet function d<x?sn't work on the Mac as this 
feature uses ActiveX controls. 

Finally, the Web Pages category includes Basic Page, Web 
Part Page, and Sites and Workspaces, The Web Part Page and the 
Sites and Workspaces pages are fairly straightforward and should 
work well on the Mac In the beta version of SharePoint v3 that I 
used for the article, it wasn't possible to edit the Basic Page 
directly in SharePoint, though you could download an edit a 

custom page if you need 
to from the document 
library where the page is 
sli } red. For quick, custom 
pages, 1 suggest using 
the Wiki Page Library 
feature and (‘rearing your 
custom pages there. 


A Typical 
Workflow 

I covered the 
workflow for SharePoint 
version 2 in my last 
article. That workflow Is 
very similar in SharePoint 
v3, but the user interface 
is different .so it’s probably 
worth walking through a 
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Figure 3. A Gantt Chart in a Project Tasks list 
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fmSQL Synch eliminates double 
data-entry tee forever. 

You can now synchronize your FileMaker and web 
(SQL) databases. Data i$ compared on a record- 
by-record as well as fietd-by-fietd basis. Existing 
databases tan be configured for synchronizing 
with just a few modifications. 

juitic Of utc leoiuieo muuuci 

Eliminates double data-entry 
Two-way synchronizing 

✓ Field level conflict checking and resolution 

✓ Setup Assistant 

✓ Creates all SQL statements for you automatically 
1 / Easily integrates with existing FileMaker 

m . . 


Download a demo, and get more information at 

www.fmSQL-Synch.com 























typical document sharing workflow from the Mac. The document 
workflow for SharePoint v3 is fairly straightforward and consists of 
the following steps* In our example, we’ll add a new Microsoft Word 
file t o a document library from the Ma c. 

1. Create your new document in Microsoft Word 2004 for Mac 
and save it somewhere on your local machine. 

2. In your SharePoint v3 document library, click upload and use 
the Upload Document page to add the file you created in 
Word to the SharePoint document library. 

3. The document is now available in the SharePoint 
document library. 

To modify this file, a Mac user should follow these steps to 
ensure that the file is locked while they work on it and is then 
updated properly on the SharePoint site, 

1, Check out the file by mousing over the file name in 
SharePoint and click Check Out in the dropdown menu. 

2, Click on the file name to download the file to the Mac. 

3, Work on the file in Word and save your work* 

4, Click Upload in the SharePoint document library to open the 
Upload Document page. 

3, .Use file browse button to add the document to the Name text 
box and make sure that the Add as a new version to exiting 
files checkbox is checked* 


When your customers 
need a helping hand, 
don't you want to be there? 



With Mac HelpMate Pro, 
you're just a click away. 
www.MacHelpMate.com/testdrive 

Mac HelpMate Professional features: 

* Zero-configuration screen sharing (no IP address, no router tweaking necessary). 
It works through 90% of firewalls and NATs. Reach anyone in the world wherever 
they are f wherever you are ... 

- Your company’s image and logo on the splash screen of the application reinforces 
your brand services and sales offerings as well as generates new opportunities 
■ Automated maintenance tasks create billable subscription-based services 

* One unlimited license covers installation for all of your customers’workstations 

* Cross platform; Mac * Mac Mac - Win, Win - Mac and Win - Win 

Mac HelpMate Professional ™ is a product of MOST Training & Consulting 
www.macworkshops.com 


6* Click OK* 

7. At this point your document is uploaded, and you should see 
die page shown in Figure 4* This page prompts you to check 
in the document that youVe uploaded so that others can 
work on it. 

6 O O CKKtffflMtl - Q^St*t-Or\,0*C 





Figure 4. After updating a document that you've checked 
out you'll be prompted to check it in. 


Working Different 

The new user interface that youll see in SharePoint 
version 3 should make it easier to figure out how to check 
files in and our from the Mac* At the very least performance 
is much better in v3 on the Mac and the pages render quite 
well In this article 1 only touched on some of the new 
features of SharePoint version 3 that Mac users will want to 
check out. For a full list of new features, take a look at some 
of the resources listed at the end of this article. Windows 
SharePoint Services (version 3) should be available in 
sometime in late 2006 or early 2007. 

Resources: 

Microsoft Office 2007 (for Windows) Preview Page (contains 
links to the Windows SharePoint Services version 3 beta) 
http://www.ru icrQSoft^com/office/preview/beta/testdrive.msDx/s 

how1ntro=n 

Microsoft Windows SharePoint Services (version 3) Technology 
Guide 

httD://www.micrQsoftxQm/office/preview/technolQqies/sharepQi 

nttechnoloQv/quide.msDX 

_ 

About The Author 

Brian Johnson is a Product Manager with Microsoft's Macintosh Business Unit. 
You ran read his blog at http://bafferoverrua.net and you (an drop him a fine 
at brianjo@microsoft.com 
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Now I Up to Date and Contact 5 

Calendar and Contact Software for Business, Groups, Families and You. 

Is this project on schedule? When ore you available to meet about the systems 
upgrade? Where are all the field techs today? When was the lost time anyone talked 
to our biggest customer? 

Virtually all groups live (or die] by their abilities to meet deadlines and keep track of 
their customers, prospects, and vendors. Few small companies or even departments 
of big companies have the tools they need. 

Now Up-to-Date & Contact might just be the calendar and contact software For you. 

It's time tested and used by more Maobased companies than any other solution. And 
it's cross-platform^avoilable for your PC users, too. It’s easy to install and manage and 
simple for your employees to understand and use. 

Using Now Up-fo-Date & Contact you can schedule meetings For multiple users, view 
multiple, simultaneous calendars, and reserve rooms and resources. You can share 
contact information about your customers, prospects and vendors. And using our free 
server software you can set if up in minutes and share with users in fhe office or from 
anywhere with an internet connection. 


P; 866 527-0556 

www. n ow softwa re com 
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Cdft us now at 866-527*0556 or erodi! us at 
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make [ ft oft daiy* of Now Up-to-Dcte & Contact* Ifawn 1 1, 
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By Dean Shavit 


On The Meaning of Influence 

WWDC is a gathering of many ambitious developers, savvy 
system administrators, Madntosh consultants, led mica 1 writers and 
journalists together with Apple's own development and IT 
engineers, where ideas are exchanged in a highly-charged 
atmosphere. It's where the “curtain” that separates the technologists 
of Cupertino from the “rest of us” who make their livings working 
with Mac OS X and Mac OS X Server Ls drawn aside tor one busy 
week. Among the thousands of attendees are a couple dozen 
people whose work helps shape the tedinieal agenda for every one 
else in the industry as well as arc of the discussion. Many such 
tlireads of though L, inspiration and conversation begin at WWDC 
and end up cm I redded in the software people use to do their daily 
work or in a network design or deployment. 

Influence is measurable by many facets, and this group of 
twenty-five accomplished individuals, accompanied by the 
seven honorable mentions that were kept off of the main list by 
"the mles,” represents a wide range of technical talent, 
communication skill, teaching ability and community-but I ding 
expertise. The MacTech 25’s gifts are also frequently 
accompanied by a heaping helping of wit, a killer sense of 
humor, and an often an extreme willingness to help others. 

Ids not easy to categorize these folks, but there are some 
loose categories that can help us understand why and how the 
MacTech 25 are helping shape our professions. The Ok! Guard 
are folks who were influential Mac folk before the advent of Mac 
OS X. The New Guard are folks were where influential after the 
advent of Mac OS X. The Hackers look for ways to wring the 
most out of Mac OS X either by spreading knowledge of how to 
do so or by writing scripts or rook The Modders are busy 
creating tools that modify Mac OS X in significant ways to 
enhance it or overcome perceived shortcomings. The Press is 
the press. The Authors write books about the Macintosh. The 
Teachers share their knowledge, whatever that may be. The 
Coders are the developers that make using Mac OS X 
worthwhile, lxxause without software, we’d be nowhere. 

Aaron Hillegas 

Hot Cocoa and a Cool Cowboy Hat 

Want be a Mac OS X Cocoa Developer? Well, you have to 
start somewhere, and it seems that 99% of those who have 
successfully made it recently in the Cocoa coding business cut 
their teeth on Aaron Hillegas’s book Cocoa Programming for 
Mac OS X. Despite iis draught-horse title, people axle like die 
pony express after reading it, and by sheer number of 
recommendations and homages paid, there’s little doubt it 


provides a lucid and friendly entry-point to what can be a 
somewhat daunting set of tools. Aaron worked for NeXT and 
then Apple before founding Big Nerd Ranch, which provides 
world-class training lor Mac OS X and Unix developers. Aaron 
also co-authored Advanced Mac OS X Programming w ith Mark 
Dalrymple as well as parts of the Mac OS X client for AOL, along 
with a few “other" projects along the way for companies like 
Nortel Networks, and the United Parcel Service. 

Member of: the new guc&d t the authors, the teachers 

Adam and Tonya Engst 

TidBITS and Books on Ihe E-Prarie 

In the publishing industry, it’s 
somewhat difficult to assign the 
label of "pioneer. n Of course, 
there's Johann Gutenberg, the 
inventor of moveable type and 
namesake of the Gutenberg 
project, a repository of 17,000 e- 
books in the public domain 
( http://www.qutenberq.org ). ft 
there’s a Gutenberg(s) in the 
Macintosh Technical community, it's Adam and Tonya Engst, the 
dynamic duo that produces TidBITS ( http://www.tidbjts.com ) t a 
weekly e-zine that’s been continuously published in various 
forms (hypercard stack, etext, html) since 1990. As editors and 
publishers of the highly successful ‘Take Control” ebook series* 
Adam and Tonya have not only made the transition from the old- 
guard to the new-guard, but managed to maintain (and even 
advance) their standing and contribution to the Madntosh 
technical and end-user community, Adam and Tonya are 
currently active in groups like MacNotables 
( http://www.macnotablesxom ). and as contributing editors to 
magazines such as MaeWorld. 

Member(s) of: the old guard, the new guard, the 
authors, the press, the teachers 

Amit Singh 

Mac OS X Hacker Numero Uno 

Someone has to wear the crown of top Mac OS XI lacker, and 
no one who lias visited Amit Singhs website— 
hTrp://mvw.kerneittiread.com (now superseded by www.osxlxxik.com) 
would aigue otherwise, it covers a amazing range of Mac OS X 
topics including command-line tools, an open contest to explain a 
flaw in the Mac OS X kernel, how to turn the sudden-motion sensor 



30 August * 2006 www.wcikh.com 












in a Powerbook into a game 
controller, as well as side-splitting 
anecdotes such as his 
misadventures at the local Apple 
store when picking up his 
Powerbook anti Ix?ing bullshitted 
by a Genius. Amit recently 
acquired a MacBook Pro and 
promptly whiptxx! up a daemon 
for controlling infrared input to 
complement his other tools like HFSDebug and SMSRotateD, (which 
rotates a Powerlxxik or Macbook's display if you stand il on its side). 
He's currently tinkering with the ambient light sensor, so I’d expect 
a kcylxiand light show that strobes with the lTunes visualizer any 
day now. Amit’s lxx>k Mac OS X Internals, a 1650-page exploration 
of Mac OS X was just published by Addison Wesley, after he worked 
on il in his as a bobby while employed at the IBM Almaden 
Research Center prior to accepting a position with Google in May. 
As Josh Wisenbaker (also of the MacTedi 25) so aptly put it, 
“Everything Amir writes Ls required reading.” 

Member of: Ihe new guard, the authors, the 
hackers, the madders, the coders, the teachers 

Andrina Kelly 

A Utile Script of This... 

If you’ve got one Xserve and 
a terabyte of data to manage, 
then your day-to-day 
responsibilities might be pretty 
routine, but when you’re 
managing an Xserve G5 Shake 
render farm for a crew of 
animators working on a 
Hollywcxxl feature animation to 
be released by WalL Disney 
studios, you're truly into high-powered and big-budget 
computing. Andrina Kelley lias been working with Macs since 
1985, but ifs her UNIX system administration and scripting 
language skills (Python, tel) that have quickly become legend, as 
she’s shared her experiences with high-performance computing 
as a contributing editor to online Mac OS X Server Community 
and e-zine afp548xom and in presentations at MaeWorid and 
WWDC sessions. Also a storage expert, Andrina manages over 
fifty terabytes of data while working at C.O.R.E Feature 
Animations (taking care of over 200 Macs) which just released its 
first full-length animated feature, The Wild, in which Andrina’s 
name appears in the credits for “administrator: Apple Systems.” 

Member of: Ihe new guard, the hackers, the teachers 

Andy Ihnatko 

The Merry Prankster 

Known for his unflappable persona, razor-sharp sense of 
humor and world-class prose, Andy Ihnatko goes about the 


business of reporting developments in Macintosh Technology 
with a sense of play that few “serious” journalists would allow 
themselves. Yet Andy is a very serious journalist indeed. As 
tecltnology columnist for the Chicago Sun-Times, lie reaches one 
of the largest readerships in the country, delivered the keynote 
address at MaeWorid Boston, is author of The Mac OS X Tiger 
Book and The Mac Xante 2 Book (which is a great primer for 
high-school students learning to code) among others, and 
develops AppleScripi Studio applications as well as Automator 
actions such as his “The Tactical Heads-Up Display Workflow!” 
presented at MaeWorid which printed a map upside down and 
backward to retied on the inside of car windshields. Some of his 
finest efforts can Ixr found on his blog 4+ Ydlowtext h part of his 
“Colossal Waste of Bandwidth” web site. Among them is a 
wonderful anecdote about getting a query from an Apple 
publicist asking if he’d lx? willing to interview Steve Jobs, and 
what it felt like to wait for the call that never came. 

Member of: the new guard, the old guard, the 
authors, the press, the coders, the teachers 

Ben Wilson 

Mr. Fixit 

MacFixIl.com was one of 
the first Macintosh technical 
mega-sites. Started in the mid- 
1990s, MacFixit Is now part of 
TechTracker Inc., and remains 
one of the pillars of the Mac 
web, with an amazing trove of 
archived information available 
for an annual subscription of 
$24.95/yea r. For many who need 
to support Macs in schools and corporate America, Mac Fixit is 
a must-have. Since 2002 t Ben Wilson has been the Editor of 
MacFixif.com, leading the site during the Mac OS X age and 
continuing the long tradition of excellence established by 
MacFixit founder Ted Landau. Currently, Ben produces the 
“AQutckFix” podcast series www. macfixit.com/quickfix.rss . and 
ensures that MacFixit remains on the cutting edge of 
troubleshooting and break fix news for iLs half a million readers. 

Member of: ihe new guard, the press 

Brent Simmons 

The News Dude 

For as long as the 
Internets been around, people 
have debated how and when it 
would fulfill its potential as a 
news delivery medium. As 
more and more Internet news 
junkies adopt RSS (real simple 
syndication) feeds as the mechanism for delivery, they need 
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software that collects that news into a single window for easy 
digestion* Brent Simmons of Ranchero software is the author 
of NctNcwsWire, one of the best RS5 aggregators, which won 
him an Eddy award at MaeWorld, an G'Reilly Mac 0$ X 
Innovators award, and a spot in last October's “Night at 
Adler/ organized by Drunkenbatman of 
http://drunkenblog.coni which featured several of the MacTech 
25. Not only does Brent and Ranchero software facilitate 
reading Internet news, his other well-known product is 
MarsEdit* which helps bloggers create the news in the first 
place. And where did Breni get his start in Cocoa 
programming? By reading Aaron Hillegas* Cocoa 
Programming for Mac OS X, what else? 

Member of: the new guard, the coders 

Dan Frakes 

MacWorld Pivot Man 



In the Macintosh technology 
world* there's a small but talented 
group of journalists whose voices 
ate well-known, respected, and 
authoritative members of the 
mainstream press* H also seems 
that many of these voices a re 
either cultivated by or flock to the 
most mainstream of all Mac 
periodicals: MacWorld, One just 
doesn't get to write for MacWorld these days; you have to lx* 
“somelxxly" first* Dan's currcmiy MacWorld's Senior Editor* writes 
the MacWorld 'Gems*’ column and is the Senior Reviews Editor at 
Playlist, as well as a contributing editor and columnist (and former 
editor) of MacFtxlt He will be speaking in MacMania 5, u cruise 
( http://qeekcmises.com ) that also features speakers such as Steve 
Wozniak. Over die years, l>an has written or contributed to a 
number of popular Mac Ixxjks, and created one of the first “eBooks" 
a decade ago. When not writing alxxit Macs* gadgets, iPods or 
audio, he spends his time with family or shooting hoops. 


Member of: the new guard, the old guard, the 
press, the authors 


Danny Goodman 

Kung-Fu Master 

Not many people have Ixen writing about technology and 
computers full-time since 1981, and if there are some out there, 
none are as visible and respected as Danny Goodman* and 
certainly mine who are masters of the Macintosh. His Complete 
HyperCard 22 Handbook, now in its fourth edition has sold 
over 300*000 copies in various languages* His AppleScript 
Handbook, (most recent edition from SpiderWorks eBooks), is 
considered to lx* the very best introduction to AppleScript after 
over ten years in print. Other subjects Danny's mastered have 
been JavaScript and DHTML Recently he wrote the Mac OS X 
Technology Guide to Dashboard , also from SpiderWorks. His 


bexjk Spam Wars is also considered to be one of the best 
explanations of what Spam is* why it exists, how- to combat it, 
and why Spammers do what they do. Over the years, Danny has 
penned hundreds of magazine arid electronic articles for 
Netscape* Apple’s Developer Website, and the O'Reilly Network 
I low does such a long-term Master known for accessibility and 
interest to novices and expeas alike gel their sum during a time 
when computers were just getting their start? By earning a BA 
and MA from the University of Wisconsin-Madison in Classical 
Antiquity, of course. 

Member of: the new guard, the old guard, the 
press, the authors, the teachers 


David Pogue 

Honey, 1 Found the Manual! 

When you've invented a way to market something that’s so 
right and appropriate sometimes that brand name often becomes 
synonymous with your name* For David Pogue* that brand is 'The 
Missing Manual" So appropriate in terms of both the need it fills 
and ihe promise of what it delivers, die phrase “Missing Manual" 
also captured a fundamental shift in expectations regarding both 
the bundled software that ships with your Mac, hut also whose 
responsibility ii is 10 teach you how to use that software. David 
Pogue sensed that shift* and timed his “Missing Manual 1 series 
perfectly* capitalizing on its success by creating his own brand- 
witliitva-brand (the Pogue Press in Partnership with O'Reilly). Old- 
guard fans will remeinlxT David for Ills Mac Secrets collaboration 
with Joseph Schorr* widely considered to be one of die finest pre- 
Mac OS X books for Mac power users* David's battle with 
tenosynovitis (akin to carpal-tunnel syndrome) hasn't slowed him 
down one bit, and his search for hardware and software solutions 
to a medical problem has been fascinating, Jn addition to being the 
mastermind of the Pogue Press* David is also a technology 
columnist for the New York Times* 

Member of: the new guard* the old guard, the 
press, the authors 

John Gruber 

Shooting Star 

To say that someone who made the MacTech 25 Ls a “blogger" 
puts them squarely into die new guard of the MacTech 25. To say 
that John Gruber is a blogger is to miss the point entirely* John is 
a*s good a writer as anyone who writes lx»ok.s or for the print 
media, it's just dial his chosen medium is electronic and wel> 
based* completely focused on the technology that makes it 
possible. Occasionally, hell also strike a chord that resonates 
across the whole Macintosh community* as lie did when he 
proclaimed: “The Location Field lof web browsers] Is die New 
Command Line*" or my personal favorite: ilife *06 From the 
Pmpectim of an Anthmfxmiorphized Brushed Metal Interface. 
“Safari: Hey. Brushed* What's up? Brushed Metal: Ah s you know. 
In the neighborhood, figured Fd stop by. Tried calling you, but 
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kept getting your voicemail Safari: (Ixnnused) It’s like eight in ihe 
morning. Brushed Metal: Really? Wow, 1 thought it was like ten. 
(Holds left wrist out.) Lost my watch , , , " 

Member of: the new guard, the press, the coders 

John Siracusa 

The Long, Long, Long, Article 

John Siracusa did us all a huge favor in April of 2005 when he 
published his highly detailed, insightful, amazingly well-researched 
and seminal article on Mac OS X 10,4 on httpi//wvwv > at 5 ted]nica,com . 
Those of us who are developers might have dipped our toes into 
the doaimentation, but John Siracusa bathed in iL t apparently for 
many months, The result was a summary of changes in Mac 05 X 
that was just the right thing for all of the tens of thousands who read 
it His treatment of extended attributes for ACLs, the mds (metadata 
service) dial powered Spotlight, and launchd, just to name a few, 
brought these new technologies into focus for nearly everyone who 
cared to read about it, telling us how they worked without having 
to wade through the morass of Apple’s developer documentation. 
You can catch up with John as he lobbies hard for things like 
garbage (memory) collection for Objective-C applications on his 
blog "FatBits" http.//arstechnica.com/stafffetbits.ars as well as the 
replacement of the Mach CXNU) Mac OS X Microkernel with 
sometliing (anything) belter. 

Member of: the new guard, the press 


Jonathan “Wolf” Rentzsch 

Mac OS X Madder Numero Uno 



If you created an open- 
source project that allowed other 
programmers to do spectacular 
things with Mac OS X that even 
Apple’s own developers didn't 
think possible, would you 
deserve to be crowned “king of 
the modders?* If you're Lhe 
Jonathan "Wolf 1 Rentzsch, anti 
you came up with mach_star 
fhttp^/rentzschxofn/mach star/) , which allow programmers to both 
override (machjoverride) the kernel as well as inject code into 
another running process (maehjnject), then the answer is J “Meh.” 
OK, well, the answer is really a resounding “absolutely/ 1 but the 
more you get to know Wolf by his writings for Apple's Developer 
site or IBM's Developerworks (http;// 

www.ibrn .com/deve lopemorks) . his own RedShed software site 
( http://redshed.net ) or his appearance at Drunken batman’s 
“Evening at Adler,” the more you find yourself saying “Meh” to 
things just like he does. Macjstar makes the magic of Desktop 
Manager and Virtue Desktop possible, as well as recent iterations 
of software such as Allume's Stuffit and The Missing Sync. It s 
currently unknown how many developers use machos tar, but since 


Wolf made it open-source, anyone can wield tills powerful tool. 
Currently, Wolf works as a developer gun-for-hire, but also leads 
the Chicago CAWUG (Cocoa and WebQbjects User Group), Of his 
notable contributions to the community in 2006: an article in 
TidBITS that led to the method of creating an external drive than 
can boot both Intel and PowerPC Macs, 

Member of: the new guard, the press, the coders, 
the madders, the hackers 

Josh Wisenbaker 

Macshome Improvement 

2005 and 2006 have lxx;n 
spectacular years for Josh 
Wisenbaker. He went from an 
underappreciated systems 
engineer at an Apple Specialist in 
North Carolina to a Senior 
Engineer at a Fortune JO company 
- Lowe’s home improvement 
stores. Previously, Josh was 
known “macshome” the sidekick of 
Joel Rennich and co-editor of AFP548.com, the online Mac OS X 
Server community and e-zine. Just as John Siracusa might have had 
the most-widelv read article on Mac OS X, there’s no doubt that 
Josh’s article on Mac OS X Server 10.4, published on afp548.com the 
day it was released, filled the exact same role for the technically 
curious server admin, followed by articles covering launchd and 
ACLs in depth. Some say that “timing is everything/' and it seems 
that Josh’s timing couldn’t be better* Just when Joel Rennich became 
consumed doing integration work in his new position as a 
Consulting Engineer for Apple, and couldn't produce as many 
articles for afp548.com, Josh stepped up to the plate and has hit 
home run after home run. 1 le’s gone from "helping" at WWDC and 
MacWorld Sessions to a being a speaker in his own right, and is now 
one of the most visible Mac OS X Server gurus on the Internet. In 
2005, Josh was offered, and accepted, an invitation to join the 
Steering Committee of the Mac Enterprise Project, 
http:yAv^v.macentemme.Qrg . 

Member of: the new guard, the press, the hackers, 
the teachers 

Michael Bartosh 

1977-2006 

l looked up to and learned 
from Michael Bartosh, as did 
many of my colleagues. 

Unfortunately, he passed away 
during the voting for the MacTech. 

25 as the result of a tragic accident 
while he was on a business trip in 

Tokyo. Michael was the author of Essential Mac OSX Panther 
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$m>erAdministration from O’Reilly, which I consider not only the 
lxst Mae OS X Server book in existence, but also the pitxlud of a 
mind that understood Mac OS X Server (from an integrators 
viewpoint) letter than anyone else I knew, Michael answered 
everyone's questions on many ILstservs. He also lived hand and 
played hard, liked to eal chili after a night out on the town and had 
a Powerfxx>k with so many dents and dings in it that it looked like 
he'd used it as shield to protect himself from a fOckslide. If the 
MacTech 25 had started in 2002, Michael would have made the list 
even them There's no doubt he would have made the list every 
year tor as long as lie wanted his knowledge to stay relevant, and 
if you knew him, you'd know he would’ve done anything to stay 
ahead of the curve that he helped create by playing a major role in 
the creation of Apple's Mac IT Training curriculum as an Apple 
Certified Trainer as well as the AGSA certification exams themselves, 
Michael was only twenty-eight w r hen he passed, but he was lucky 
to discover his calling at an early age. He was our Mozart, anti Mac 
OS X Server was his instrument. 

Member of: the new guard, the authors, the 
hackers, the teachers 

Drunken Batman 

The Batlight Is Lit 

A year and a half ago, when Macs with Intel processors were 
just a glimmer in the eyes of aimor-mongers, a product appeared 


which titillated many of us. It was called ChenyOS, and claimed to 
allow the owner of a PC to install and run Mac OS X in a virtual 
machine* Upon cursory examination, it became obvious that 
CherryOS contained unacknowledged code from PearPC, a popular 
open-source project Enter Dronkenbaiman, blogger supreme. 
Already known for organizing online events such as the RSS 
roundtable through his blog http://wvwv.drunkenblQa.com . he put 
together an online expose of Maui-XStream ftlve company behind 
CherryOS) that is simply amazing in scope and breadth, as it not only 
follows the story to Hawaii, but also to India, Drunkenbaiman also 
specializes in-depth interviews with other members of the “indie' 
Mac OS X Developer community. In October of 2005, he organized 
the amazing "Evening at Adler" in Chicago, attended by Mac OS X 
Technologists from all over the country. Among those in the MacTech 
25 featured in tire event were Wil Shipley, Jonathan "Wolf'’ Rentzsdi, 
Brent Simmons, and Rosyna Keller, lately, though, Dninkenbatman 
or "DB" as he's sometimes called, has simply vanished, leaving a 
blank white page on his blog. We've left the Batlight lit, because we 
want him to come Ixick. No questions will lx* asked. 

Member of: the new guard, the press, the hackers 

Mike Breeden 

Because Everyone's a Hotrodder at Heart 

Without hardware, where would we be as Mac users? It’s 
sometimes easy to overlook (not so easy to overdock), while 
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trying to wrap one's head around the complexities of the various 
layers of Mae OS X, just how important (and fun) Mae hardware 
can tie, From the challenges of flashing off-the-shelf video cards 
to the teeth-gnashing quest to find a SCSI adapter for under 
$1000 dollars, to finding out just which G3 and G4 processor 
upgrades perform the best, how to replace your Core Duo or get 
rid of that yucky thermal paste, www.xlr8vourmac.com lias been 
the place to go to read about others* experiences before 
plunking down your dough. Mike Breeden is the one who's 
runs the show of this Mac technical megasite that’s been going 
strong since 1997. 

Member of: the new guard, the old guard, the press 

Nigel Kersten 

Under the Hood Down Under 

There’s few Mac OS X admins 
that tackle problems with the skill 
and ingenuity of Nigel Kersten, 
who is the Senior Technical Officer 
for College of Fine Arts at the 
University of New South Wales, in 
Sydney Australia. Recently, Nigel 
wrote a revealing article on AFP 
(Apple Filing Protocol) for 
http://afp548.CQm that investigated 
the nuances of the tweaking the AFP client and optimizing AFP 
server performance through tuning kernel parameters and 
redirecting home directory caches to the local hard disk. His recently 
released application, Sir Admin, provided die first Gill for die 
relatively complicated cyradm ACL manager for Cyrus (the 
intap/pop mailbox server tor Mac' OS X). Nigel has also kepi die 
admin community on its toes with scripts for home directory quota 
management and even relocating portable home directories to 
another partition so that laptops tun be easily re-imaged without 
losing user data. 

Member of: the new guard, the hackers, the 
teachers, the press 

Ray Barber 

Your World Scripted! 

There are pioprietotVfbunders of many online communities 
represented in the MacTech 25: afp54Rcom, www.xlr8yourmat.com. 
macfixit.com. macosxhintsxom. and madntouch.cQm. [ will however, 
admit that my favorite, at least for die pasi year, has been Ray 
Barber's Macscripter.neL Many communities help out with die liow 
to" portion of things by posting articles or examples, but 
Macscripter.net is inhabited by so many skilled and helpful scripters 
that one could almost write a complex and full-featured AppleScript 
or AppleScript Studio Application just by posting a series of the 
proper questions in die right sequence on the MacSaipter forums. 
Because people share "snippets" of actual code, for the most part, 


you're always closer to die answer than you think, and sometimes 
just a heartbeat away from a breakthrough. Recently, Ray built on 
his success with Macscriptcr.net by launching a new project: 
http ://macdevelope r, ri e t a “marketplace for businesses to post 
outsourced projects to a pool of quality Mac developers in a reverse 
auction styled environment. 11 

Member of: the new guard, the old guard, 
the teachers 

Ric Ford 

The Human Touch 

Another proprietor of a successful online Mac technology 
community is Ric Ford, of http://wvM.macintQLich.com, which has 
been in publication since 1994, making it one of the oldest Mac 
megasites in existence. Cleverly, Madntouch still relies on a very 
old model to keep itself interesting and fresh: ii lakes" news 
from tis own readers by email submission, then posts that news, 
opinion, or review by simply stating: "Macintosh reader so-and- 
so notes that. ... 11 followed by the text of the email. In these 
days of RSS feeds, syndication, banner ads and those awful 
un subtle ‘TntelliTXT” ads with the double-underline, 
Macintouch.com captures the essence of community without the 
bells and whistles, gizmos and gadgets, with no frills and an 
editorial touch for elaboration by juxtaposition, rather than by 
exposition. By simply placing news submitted by actual Mac 
users in carefully organized and timely topics, Madntouch 
makes magic for its readers every day, without trying too hard, 
and with the guiding touch of real human beings. 

Member of: Itie new guard, the old guard, the press 

Rich Siegel 

Software That Doesn’t Suck 

BBEdit ( www.barebones.com ) 

is has been/still is the editor of 
choice for so many Mac 
programmers, web developers 
and scripters that it's literally as 
legendary as the Clams the 
dogcow. If you don't know what 
"moQp is or have never heard of 
Clams, then you have as little a 
chance of being a old guard Mac 
professional as I (in my early 40s) have of learning to shred on 
a snowboard or grind down a handrail on a skateboard. BBEdit 
was one of the first interactive editors, You could, for example, 
open a web page directly from a site, edit it, save it in place, and 
see the results immediately, with the ease of using an FTP 
program, rather than stepping through screen after screen of a 
convoluted site configuration wizard. Today, BBEdit not only 
previews HTML pages, but will also preview the results of a shell 
script or scripts in other interpreters, all the while keeping the 
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customize fields 

New! Full Unicode support maintains international 
characters across various languages, ensuring 
data is not lost or misinterpreted 


Seapine Software Product Lifecycle Management 
Award winning, easy-to-use software development tools 


* Advanced branching simplifies managing multiple 
versions of your products 

■ Fast and secure remote access to your source 
files and defects — work from anywhere 
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solutions support Mac OS X, Windows, Linux, and Solaris 

* Exchange data using XML and ODBC, extend and 
automate with SOAP support 

* Licenses priced to Fit your budget 
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list of files you're working on in a handy drawer, also providing 
a unique command-line to GUI bridge that allows sysadmins to 
edit UNIX configuration files in place. It also still gracefully 
mediates the sometimes difficult collisions of linefeeds and 
linebreaks, the old way of doing things and the new. Oh, it still 
zaps gremlins* 

Member of: Ihe new guard, the old guard, the coders 

Rob Griffiths 

I Haven't Tested This One Yet 

Another beloved Macintosh online community is 
http://www.macosxhints.CQrn. which, like Macintouch, is powered 
by contribution from readers, but with a unique twist: readers 
submit a “him" which can take die form of a power user tip, a 
low-levd liaek, or even a script in just about any language. The 
objective^) are obvious—learn your Mac, enhance your Mac, 
extend the functionality of your Mac, learn to do something on 
your Mac in a whole new way. As you can imagine, it can be 
crazy trying to keep over eight thousand individual hints 
oiganized by category and type, not to mention by version of 
Mac OS X, Rob Griffiths has not only manages the circus, by has 
mastered the circus of MacOSXHints and even rakes the time to 
test the individual hints himself, while writing a column for 
MaeWorld and his own blog http://www.robservatorv.com . Also, 
some knowledgeable web developer types secretly blame Rob 


for elevating Geeklog, the content management system which 
powers Macosxhints.com (and now afp548.com) to somewhat 
mythical status. 

Member of: the new guard, the hackers, the press 

Rosyna Keller 

Userland Heir Apparent 

'[here are certain people that make themselves valuable 
through their posts on other people sites, and Rosyna Keller is one 
such person, At tills time, it's also unclear as to whether or not 
Rosyna occupies the same plane of existence as die rest of us. It 
seems that Rosyna has some sort of professional relationship with 
die good folks at Unsanity ( http://www.jjnsanitv.com) the creators of 
the APR Application enhancement system, is credited with writing 
specific Unsanity applications. To quote Drunkenbatman of 
dmnkenblog.com about Rosyna's appearance at the Evening at 
Adler: it’s really, really hard to describe The Rosyna. huL I suppose 
“Anime-loving, sexually-androgynous opinionated programmer for 
Unsanity, currently responsible for FontCard, Silk, Menu Master, 
CEE PEE YOU, etc.” might work.” If there’s some common-sense 
spankin’ to be done to a blogger or comlunist out there, Rosyna s 
there to do it. 

Member of: the new guard, the madders, the coders 
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Kerio MailServer 

A groupware alternative to 
Exchange that syncs calendars, 
contacts and email with Entourage 
and Outlook. Integrated anti-spam 
and McAfee virus filtering provide 
secure, junk-free email for users on 
any platform. 

Mac OS X • Linux • Windows 


www.kerio.com 
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Beyond Scripting. Professional Programming for the Web. 


Universal Binary 

Includes AJAX Tags 

Built-in LDAP 

Connect to 

for Intel Macs: 

and Functions: 

Integration: 

Any Data Source: 

Native support for 

Supports Web 2.0 

Integrates Lasso 

Including Oracle, 

the best speed 

techniques for modem, 

with office data 

PostgreSQL, MySQL, 

and compatibility. 

dynamic Web design. 

and login systems. 

FileMaker, ODBC and JDBC, 


Improved DNS, Email, 
iCal Support: 

Extending Lasso's support 
for Internet protocols and 
open standards. 


Advanced Features for Advanced Developers 

Lasso Professional empowers the productivity-focused developer. 
The language is dnan. dear and consistent, making new coda easy 
to write and un-going maintenance mare productive. High-level 
language leatures significantly reduce the amount of code required 
In accomplish tasks compared to ether languages, and integrated 
libraries fur SOAP, XML, PDF, SMTP anti many mure provide lurn-key 
efficiency for feature rich applications. Lasso Professional Server 
provides mjt-of-The-box connectivity to industry-leading databases, 
robust security administration, isolated environments for each 
application, and enables "build once, deploy anywhere” solutions 
through support of major operating system platforms 



Database-Independence: Use high-level Lasso syntax ro write database 
agnostic code, or pass database-specific queries to get the most out of 
your database, Lasso lets you change your database without requiring 
any re-prog ramming. 
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Salvation Awaits You. 



Convert Now. 

Change the way you live, work and play. Convert to Razer 
Pro|Solutions™ for faster speed, more accurate control, better 
response and superb precision, tn essence, increase your 
productivity. It is the Way to perfection. Born from a marriage of 
form and function, the Pro|Click™ vl .6 is a godsend. 

Surrender to Salvation. Click & Convert Now. 


Works with both 

PC and Mac 


find out why you should convert @ 

www.razerpro.com/convert 


Available at: 
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Scott Knaster 

Clever Quipper Here 

No matter your entry point into the world of Macintosh, 
you’ve come across Scot! Roaster's influence. Jack of alt trades, 
master of all, he’s written or co-authored dozens of books on 
wide-ranging Mac topics. Turns out, they typically turn into Mac 
best sellers too, A former Apple employee (’from the 68000 
days), Scott has a wealth of anecdotes from his contacts too 
numerous to imagine. Let's put it this way - Scott may be the 
only person to have held positions at Apple, General Magic (!) 
and Microsoft for at least 5 years each. Of course, he is so 
widely recognized because he brings his infectious humor and 
charm to every task he undertakes. If you re looking for Scott 
these days, you'll find him writing even more books, speaking 
at MacWorld, and enlightening us with random life tidbits at his 
blog (http;//foodisworse.typepad.com/this/). Scott influences 
just about everyone in the Mac community either directly 
through his willing, teaching and speaking, or indirectly though 
bis vast array of contacts in the Mat' universe. 

Member of: the old guard, the new guard, the 
hackers, the coders, the authors 

Wil Shipley 

Pimp My Code 

Anyone making a lisi of the 
top ten Cocoa programmers 
outside of Apple would have to 
include Wil Shipley, who founded 
the OmniGroup and now founder 
of Delicious Monster, maker of 
the Apple-Design-Award-Winning 
(2005 Best User Experience) 

Delicious Library, which, among 
its dozens of amazing feutues, 
uses an iSight camera as a bar code scanner. Wil lives in Seattle, 
drives a red Lotus Elise, and in addition to Delicious Monster 
t www.delid ou s-monsterxom ), also runs a site called "Pimp my code” 
where he shares his deep knowledge of Cocoa with anyone who 
cares to read it; htt p://wilshipley.com/bloQ . and it s g<>od reading— 
witty, interesting, full of history and time-saving wisdom. Wtl’s won 
a total of seven Apple Design awards f the equivalent of the 
Academy Award for Mac OS X programmers and is a role model 
for several generations of aspiring Qx:oa programmers, even 
though he probably wouldn't want to lx* one. Wil gave an 
inspirational talk to students at WWDC 2005, participated in 
Dninkenlzatman’s Evening at Adler, and started programming 
using Project Builder for NeXTStep in 1989. 

Member of: the old guard, the new guard, the 
hackers, the coders, the authors 
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Working through 

SURPRISES REQUIRES 
THINKING DIFFERENTLY. 

We can help. 
Don’t let your goose 

GET COOKED...LOOK TO US 
FOR THE STRAIGHT STORY ON 
HOW TO MAKE THE MOST 

of your Windows network, 
Exchange & Outlook 

EMAIL ISSUES, AND 
SECURITY CONCERNS— 
WITHOUT ANY 

Microsoft spin. 

WINDOWSITPRO.COM 


WINDOWS IT PRO. 
THE LARGEST 
INDEPENDENT 
WINDOWS 
COMMUNITY 
IN THE WORLD. 
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Honorable Mentions 
Dave Mark 

Spider Man 

If you've been around the 
Mac long enough, you may 
remember some of die early 
Mac programming books—few 
and far between, with good 
ones being even more rare. 

You may also remember that 
more than one was written by 
Dave Mark. The popular 
“Macintosh Programming 
Primer* series was one of the first books many Mac 
programmers of today remember picking up. If you're new 
Lo the Mac, you may have purchased an e-book from 
Spiderworks, Daves new publishing company formed along 
with Dave Wool ridge, Spiderworks' books cover topics 
relevant to the Mac today, webbing-in authors old and new, 
including titles from Dave himself and Danny Goodman, just 
to name a few. Dave’s influence is evident from the top- 
notch authors he draws upon to write relevant material that 
teaches the new generation of Mac hackers. 

Member of: the old guard, the authors, the 
teachers, the press. 



HostedStore / 

HostedStore provides a TURNKEY 
SOLUTION FOR CREATING A WEB STORE, 

yet is extensible so developers can use 
the application as a base for creating 
customized solutions for their clients* 




The extensibility of HostedStore provides a 
structure which allows developers to 
create modules that add new functionality 
or alter the built-in features. 


We are seeking software resellers, hosting 

-providers, developers, and designers that 

currently offer or plan to offer ecommerce 
/ solutions to their clients* Resellers receive 
a discount off of the published list price of 
our software and are free to bundle our 
software with their own products and/or 
services* 
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Joel Rennich 

Trolling for Servers 

A common thread amongst die honorees here is their 
willingness to share their knowledge. In 2002, Joel set up an 
entire site to do just that* Helping to “change the world, one 
server at a time/ afp548.com is the destination for frustrated OS 
X server admins everywhere* A former photographer at United 
Press International, Joel left his post to form his own consulting 
company where he spread his Mac OS X Serv er experience as a 
travelling Apple Certified Trainer. After tackling deep and esoteric 
issues on afpS48, his high profile landed him a new job as a 
Consulting Engineer with Apple Computer. Joel travels the world 
to set up and secure new networks as well as and rescue existing 
ones. Of course, he continues to share tips, scripts, and answers 
questions at afp548 using his handle, MacTrolL Joel has helped 
introduce many Mac OS X sysadmins to pushing the bounds and 
not simply relying on the stock tools that Apple provides. 

Member of: the new guard, the teachers, the press 

John Welch 

That's Not Going to Work 

Some people just seem to be everywhere you turn. 
Omnipresent, if you will John Welch fills that role in Lhc Mac 
community, and is a i a lent writer with a unique penchant for 
pointing out the sometimes asinine assumptions certain 
computer companies (Apple, Microsoft) make in their corporate 
computing strategies. A strong presence on the Mac OS X Server 
list and the Mac Enterprise lists, John also writes for MDJ, IT 
Enterprise, MacTech and maintains his own blog at bynkii.com 
and is a regular speaker ai MacWorlri. John approaches all of this 
with a practical, common-sense style, and the ability to drop his 
opinions like precision-guided missives cultivated, perhaps, in 
his 6-ish years in the US Air Force. All this and he manages to 
keep up with the demands that overseeing IT operations for 
Kansas City Life Insurance place on him. Youll see John’s 
influence dearly in long threads on mailing lists where his well- 
reasoned comments sway more than a few to see things his way* 
or at least l>e open to new opinions. Oh, and did I mention that 
he hates Star Wars with a vengenee? Hates it, he does. 

Member of: the old guard, the new guard, the 
press, the authors, the teachers, 

Mike Bombich 

Owns IT 

If anyone “owns* Mac 0", its Mike Bombich. While oilier 
sysadmins have dabbled in AppleScript Studio to make simple 
graphical interfaces for scripts* his backup and cloning utility, 
Carbon Copy Cloner may have been downloaded nearly one million 
times, and works amazingly well for end-users and sysadmins alike. 
His other major project, Net Restore, which started out as a simple 
front end for slinging ASR images over NetbcxH, lias become a rich 
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mass deployment and computer management system that recently 
gained the capability of imaging dual boot computer labs. 
NetRestore as also Ixjcome one of Apples worst-kept secrets— 
shunned from certification curriculums and tile Mac OS X Server 
Admin Guide, it is simply used by everyone. Mike also shares his 
source code, which has Isecn invaluable for AppleScript Studio 
programmers as a reference of how tilings “should l>e done.“ And, 
if that weren't enough, lie also publishes some of the most widely 
read teclmical articles and hosts the premier community focused on 
Mac OS X Deployment at htt p://www.bombith.CQm . For the last lour 
years, Mike has worked for Apple, while remaining amazingly 
productive at his "hobby/ all at barely thirty years old, if that. 

Member of: the new guard, the coders, the 
hackers, the teachers 


original “Inside Macintosh* 1 series of books - serious exercise 
material. If you need to wrap a streaming Flash-based audio sample 
in Quicklime and display it through your Gxrai or Cyrix m app, Tim 
can surely point you in die right direction. Since QuickTime is a 
cornerstone of die Mac experience, Tim holds an important place in 
uur list: by guiding programmers cdd and new in die ways of 
Quicklime, he ensures diat we ll all see more of the media-rich 
applications dial we’re accustomed to and rely oa 

Member of: the old guard, the coders, the press, 
the teachers 
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About The Author 


Schoun Regan 

Teaching Old Dogs New Tricks 

Seems to be titat people either know 
of Schoun, or they don't* In either case, 
you’ve probably been downstream of his 
influence in one manner or another. 

Unlike some others in this list, outside of 
a |x>st here or there, lie’s not very active 
on mailing lists. Nor has he set up a web 
presence that aims to give you every 
detail aixttit the Mac. However, that is 
more than made up for in Ills speaking 
(MacVCbrld, WWDC, MacRefreats, etc.) and authoring and editing 
(Peachpit's Visual Quickstatt, Apple s Pro Training series, articles for 
MacTech and others). Also* you may have taken one of the many 
Apple certification courses that he teaches as CEO of his training 
company, IT Instruction ( http://www.itiristnjdion.com ). Sound busy? 
You bet! So, if you’re Schoun, what do you do with the slices of 
non-work time? “Cleveland is my home. Outside of the Mat 
community, I lead a quiet, simple life. I enjoy my family and 
watching baseball. I've been to most of the stadiums across the 
United States and Canada in my travels. Cleveland still lias llie Ix sl 
park for Baseball (Jacob s Held)/ 

Tim Monroe 

Time Master 

Some people go broad with 
their skill-set. Others go deep into 
one. When ii comes to QuickTime, 

Tun site in the latter category, A 
sixteen-year veteran of Apple 
Computer, he holds the position of 
Senior Software Engineer in the 
QuickTime group* A frequent 

speaker, author of two books, QuickTime Toolkit, Volume One, and 
QuickTime Toolkit r Volume Two, youll also find Tim fielding 
questions from beginner to advanced on many lists, Apple anti third 
parry. Prior to his programmer role, he authored several of the 




Dean Shavit is an ACSA (Apple Certified System 
Administrator) who loves to use a Mar, but hates 
paying for software. So each month he's on the hunt 
for the best Open-Source and freeware solutions for 
OS X, Besides surfing for hours, following the scent 
of great source code, he's a partner at MOST Training 
£ Consulting in Chicago, where he trains system 
administrators in OS X and OS X Server, facilitates 
Mac upgrade projects for customers, and writes for his own website, 
cwwwJhemachelpdesLcomx Recently, he became the surprised father of an 
application: Mac HeipMaie, available at <www,mackelpmate,com>, If you have 
questions or comments you can contact him: <dean@macworkskops>com>. 
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Mac In Tat SHELL 


by Edward Marczak 

GUI-up your 
Script 


OK - Perhaps the GUI is nice 
every now and then ... 

Introduction 


ignored) some of the AppleScript options. More importantly, if 
you’ve never installed XCode, you’ll need to for the rest of this 
article. While the XCode environment ships with each copy of 
the OS, the retail disc is a lit tie dated ai this point. Bring 
yourself to <http://developerspple.com>, sign tip for a free account, 
and download the latest version of XCode (2.3, as of this 
writing, weighing in at 91 SMB), 

With XCode installed, it’s time to launch it. You 11 find it at 
/Developer/Applications: 



Figure 1: XCode icon 

You may not notice that it's up and running. In its minimalist 
way, there's no splash screen or other trumpeting of its arrival. 
Choose New Project from the File menu: 


While 1 can extol the virtues of life in die shell, I do 
realize lhat sometimes, just sometimes, a GUI is more 
appropriate. Why would I say such a thing? Because there 
will be scripts that you write primarily to be used by other 
people. The kind of people that don’t keep a terminal 
window open 100% of the time. On one hand, you've found 
a great solution to their issue. On the other, you don’t want 
the cure to be more painful than the disease. The wonderful 
thing about Apple's XCode development environment is that 
you can take practically any shell solution and turn it into a 
GUI-based one without too much effort. That’s where well be 
heading this month. 

What’s New in AppleScript 

Did 1 just say AppleScript? Yes, yes 1 did. The history of 
AppleScript is outside the scope of this column; it is very lengthy. 
It is now, however, a mature technology. Even more exciting is 
the inclusion of “AppleScript Studio" into OS X and XCode, 

Now, you won’t find an application, or even a submenu that 
launches anything called “AppleScript Studio." AppleScript 
Studio refers to the ability of XCode to lake an AppleScript app, 
tie it into all of the other XCode technologies and compile it into 
a native Cocoa app. This makes creating a basic application 
mind blowingfy simple. We’re going Lo create a small sample 
app to prove this. 

Fire Up XCode 

If you’ve never launched XCode, now's your chance to dig 
in. If you're an XCoder already, you may have missed (or 


File 


New Project... OSSN 

New File.,. 

New Empty File A ^N 

Open,., 3SO 

Open Quickly.,, O3€0 


Figure 2: New Project 

When presented with the choice of the kind of project, choose 
“AppleScript Application” and click Next 1 , Name your project 
“ the example this month is "Backup", if you're following along 
- and where you warn ii saved. XCode will create directories 
for you if necessary. Once you give it the go ahead, you’ll be 
staring at a fresh new project, 
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Figure 3: Default Project 
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3,248 hours typing code 


184 hours finding that one bug 
142 hours of meetings 


14 cancelled weekend trips 


11 all-nighters 

1 call protects it all! 


#1 Choice of Software Developers 






The new HASP family of products is the 
next generation in protection ensuring the 
highest level of security for your software. 

It provides an easy set of tools to automati¬ 
cally protect your software and implement 
new and innovative licensing options. 




► Strongest anti-piracy solution: 

Our powerful, 128 -bft AES 
encryption provides a 
strong locking mechanism 
that ensures you get 
paid for every copy of 
your software. 


PtCflYPlEO DATA 


► Robust envelope: 

Automatically protects Windows 
executables, DLLs, Net and 
Mat applications, securing the 
weakest link and ensuring your 
valuable IP remains unreachable 
Multiple protection layers 
provide unequaled security. 


Random multiple 
protection layers 



► Rest overall solution as rated by 
an independent testing tab: 

In Key Labs tests, HASP HL outperformed 
the competition in security, ease-of-use, 
flexibility of tools and functionality, 
and compatibility across platforms 
and environments. A copy of the full 
Key Labs report is available from our 
Web site at www.Aladdin.com/MacTech. 
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Weight 

Aladdin Sentinel 
HASP HL UlltaPro 

Security 
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609% 
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Licensing 

20 % 
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75% 

Flexibility oi tools 
and font linnafpTy 

10 % 

913% 

71.2% 

Compatibility across 

platforms and 

environments 

10 % 

93-3% 

71% 

Overall Evaluation 


87.3% 

69.8% 
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Lot of stuff - stay cool. In the "Groups & Files" pane, you’ll see 
a ‘Scripts' folder. Since we’re going to lx/ writing an AppleScript ihui 
will front-end a shell script, as you can imagine, this is where the 
bulk of the action will take place for us. Of course, we need to 
begin at the beginning, fjet’s write the shell script. 

The Heart of the Matter 

The real work will be done by a shell script, so we need to 
have that tn place. This will l>e a lire* version of a solution I 
really have put in place. However, there were enough things 
that were specific to the environment in question, that 1 don’t 
want to reproduce here. Additionally, I won't be getting into 
any heavy error checking or correction. Nor will I make the 
claim that this is a perfect l it for any other particular situation. 
That said. I’ll offer this basic script as our base: 

#1/bin/bash 

ditto rsrc /Files /Volumes/Rsckup_Orive/Files 

This one-liner uses the OS X native ditto command to copy all 
files from /Files to /Volumes/Backup_Drive/Files. Ill 
stick the -rsrc’ switch in there as it only became the default 
Ix/havior as of 10.4, What if we want to run this on a Panther 
machine? Use your favorite text editor to create this script, and then 
save it. Call it “backup,sh". Mark it executable with chmod 770 
and test it. You may need to modify the path mimes, or, for testing 
purposes, simply copy Ixrtween two folders on your local drive. 

Have it working? Great. Now, we can drag-and-drop this 
script right into our XCode project. Locate this script in the 
Finder, and drag it into the Scripts folder. You’ll be asked how 
to reference this file. Ensure that die "Copy items into 
destination group's folder 11 is checked, and dick add. 

5? Copy items into destination group's folder (if needed) 
Reference Type: ' Default _ fr j~] 

Text Encoding: Western {Mac OS Roman) _l_*J 

© Recursively create groups for any added folders 
G Create Folder References for any added folders 

Add To Targets 

^ Backup 


Cancel ) ( Add } 

A 

Figure 4: Copying a script into XCode 


You should see your backup.sh script listed alongside the 
pre-loaded AppleScript file. Like so: 

Groups & Files 
▼ ^ Backup 
▼ j~ Scripts 

Backup.appsescript 
■ backup, sh 
► [ Resources 

__ k .. ~ jXtoAfc^QjtJiarjDif____ 

Figure 5: Your script has been added 

If you've never used XCode before, please do this now: 
click on the build icon in the toolbar. This will help you 
understand how XCode lays out your project. Open up the 
folder where you saved this project. Inside, you'll Find a folder 
named ’build'. Inside of that, you’ll find one named ‘Debug 1 , 
and it will contain your Backup.app. See how easy that was? 
OK, not so fast, right? Although this app actually will run (go 
on, try it), it won’t do anything of use. Right-dick (control-click) 
on the app and select "Show Package Contents”. Open the 
resulting 'Contents' folder, and the ‘Resources 1 folder beneath 
that. You should see three objects: backup.sh, English.Iproj and 
Scripts. Well, there’s our ‘backup.slY file! Now we know where 
it lives and how to access it. 

Get GUI 

Back in XCode, toggle the disclosure triangle next to the 
Resources' group. Double-click on the Main Menu.nib’ file. 
This will launch Interface Builder, and even more windows will 
now liner your screen. Click once on the window labeled 
'Window', Let’s immediately name it something more relevant. 
Change the Window Title in the inspector pane, and title the 
window “Backup”. Also, we need to give it an AppleScript 
name, Change the drop-down menu in the inspector to 
“AppleScript*. Name the window "wMain”. Now, look for a 
button in the ‘Cocoa-Controls’ pane. Drag it to the lower right- 
hand corner of our window You’ll see guidelines appear to 
help you position it. With die button still selected, let s make ii 
say and do something appropriate. Back on the attributes 
screen, update the button title in the inspector pane. (Change 
the drop-down menu to gel hack to the attributes screen). 
Additionally, change the ’Key equiv. 1 to ‘\R F - type it in or use 
the drop down menu to select 1 Return’, and check the ‘Selected’ 
checkbox. Flip the inspector back to AppleScript, and give this 
button a name. How about "bBackup? 

Now to begin to tie it together: Making sure that you’re 
still in the AppleScript portion of the inspector, place a check¬ 
mark in the Action' box, and select die ‘Backup.a pplescript 1 in 
the list at the bottom of the Inspector. Save and quit. Not too 
terrible, right? Of course, now we have to make that 
AppleScript do something. 

1 am not, nor will 1 pretend to be an AppleScript gum. 1 can 
deal with tile basics well enough, and diey are easy to pick up. 


48 August * 2006 


WWW.MACTECH.COM 

















Moving to 



We can deliver. 



Our technical expertise spans the entire spectrum of software development, including Mac and Windows 
applications, system-level programming, cross-platform design, handheld and wireless platforms, gaming, 
weh development, and everything in between. We offer comprehensive development 
ervices including project management, software design, implementation, and quality assurance. Our work 
'eludes commercial projects for worldwide external release, applications for vertical markets, and custom intra- 
ompany enterprise software applications. Check us out at www.criticalpath.com | info@criticalpalh.com 

axis Critical Paid Software Inc. All tfBdcmwkj nro the prnpfity erf ifwii fwpsdmj owriery 


Critical 

















However, once you start doing this, and you get hooked on it t do 
yourself a favor and hit some of the many fine AppleScript 
resources available. This includes Ben Waldie's AppleScript column 
right here in MacTech. He’s also written some excellent books, 
available through SpiderWorks (http://www,spiderwork.s.com). 
There's also <http://www,macscripter,net > 1 another wet>hased 
resource. However, to simply front-end a shell script - no matter 
how complex -you'll find all you need in this one column. Just 
do realize that you can do some very complex scripting with 
AppleScript, and in an all Mac environment is well-worth learning. 

With that out of the way, let's continue. Back in XCode 
proper, double-click on the ‘Backup.applescripi 1 in She Scripts' 
group. Youll see that XCode give you some pre-populated 
comments for you to Lailor to Lias project. But comments don’t 
cause any action! Place these lines into the script: 

on clicked theObject 

— setup 

set ByPath to POSIX path of (path to no) as string 

— Do it! 

do shall script quoted form of myPath & 
"Cofitcnts/Resources/backup. sh" 
end clicked 

As you type this in t all text will be set in a purple mono-spaced 
font (by default, anyway - you may have changed this 
preference). Once you save, the parser comes alive to check the 
validity of the script. Valid strings and recognized keywords get 
color-coded and set in a different font. What did we just tell our 
application to do? Actions performed on the button will be sent 
here since we used Interface Builder to tie an action to this 
particular script. In this case, were interested to know when 
someone dicks on the button. 

The first line (set myPath..,) sets the “myPath" variable to 
the path of the application. Hits lets the user place this app 
wherever they want on their file system, and we can deal with 
it at runtime. Next, we call our shell script. AppleScript gained 
the ability to call scripts with the "do shell script” command. 
Currently, we know where our app lives and have stored that in 
a variable, my Path. Earlier, we verified where our script lives 
inside our application bundle. Now we know where to go 
relative to the app. We can launch our script from the 
‘'Gmtenls/Resources* folder below “myPath". 

Is it really this simple? Let's find out. First: go load up your 
/Files directory with some files and folders. Then, back in 
XCode, dick on the "Build and Co” icon in the toolbar. A build 
window will appear and give you build status. Once complete, 
you’ll see the window that we created earlier in Interface Builder 
with its one lonely button. As you can see, it Ls the default 
button, and has the Aqua default pulsing glow. Go ahead and 
click the “Backup” button. Our app will run our shell script 
buried in the application bundle. Depending on how much stuff 
you loaded into the /Files directory, tills may take a minute. Do 
notice, though, that while the underlying script is running, the 
button stops pulsing. Once the script finishes up. the button will 
pulse again. Press Apple-Q or select “Quit NewApplication” 
from the “Backup* menu. 


The answer, then, is “yes! It is that simple/ Of course, not 
only did we not write a very' friendly application, there are some 
other things w'e need to lake into consideration. However, if all 
you ever want Ls a one-button method of running a shell-script, 
now you have the framework to do so. This isn't anything I'd 
hand a client, of course. 

Version 1.1 

Before l continue to spill letters onto the page, there’s a much 
more important source before we continue, “do shell 
script” is addressed in detail in Apple's Tedmote TN2065. This 
Ls a must read. URL in the references at the end of this article. 

Moving along, we need to create better feedback for the 
client when they run our application. Double-click on the 
MainMenu.nib file once again (in XCode), You should see our 
a ppiicati<)n’s wind< )w displayed by defau 11. If not, dotible-click 
the “Window" icon in the “MainMemi.nih (English)" window. 
Drag a progress indicator from the Cocoa-Controls window onto 
our main window' - place it just a!x>ve the backup button, and 
stretch it horizontally to the width of the window. Then, with it 
still selected, change the drop-down menu in the inspector to 
“AppleScript”. Give this control a name...like. “pMainProgressl 
(1 used La code in VB and RB and, yes, Hungarian notation is 
driven pretty deep into my brain). We need this name so we 
can refer to the control in axle, Save and quit Interface Builder. 

Once again, we Ye in the position of writing code that will 
actually make that progress bar do something. Fortunately, 
AppleScript makes it pretty trivial. You'll see why we need to 
name objects so AppleSc ript can reference them. Here's one of 
the lines well need to add: 

set uses threaded animation of progress indicator 
“pMainFregress* of window "wH.iin“ to true 

(While this may wrap in prim* you should type it as all one 
single line with no line break). 

Since we can have multiple windows, each with multiple 
progress bars and other objects* we need to lie specific. We 
need to set the “uses threaded animation" property of the 
progress bar All, which progress bar? The one we called 
“pMainProgress”. Well, on which window? “wMain”! 
AppleScript's goal of Ixring English-like works in its favor most 
of the time. Other times, you can get some pretty bizarre 
sentences. Well place all of our code right in the on clicked 
section, because we only want the progress bar to animate while 
the backup is running. The fully updated code follow's (and 
look for tlie start and stop of the progress bar): 

on clicked theObject 
setup 

set myPaLh to POSTX path of (path to me) as string 
“ Start progress bar 

set uses threaded animation of progress indicator 
"pMainProgreEs" of window "wMain* to true 

tell progress indicator "pMainFrugress" of window "wMain’' 
to start 
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- Do ill 

do shell script quoted form of my Path & 

*Contents/Resources/backup, sb" 

Stop progress her 

tell progress indicator “pHainProgress* of window “vHairT 
to stop 

set uses threaded animation of progress indicator 
“pMainFrogress" of window "vflairT to false 

end clicked 

(Again, these lines wrap in print, Inn they should not be 
artificially broken when you type them). 


problem, we show a dialog tox that explains that there has been 
a problem. Try blocks can certainly get much more elaborate. 

What might be a reason that we'd have an error in our 
script? Perhaps were asking it to backup areas of the file 
system that we don’t have access to? In that case, you can have 
your script run with administrator privileges. You do this with 

the.wait for it ../with administrator privileges" parameter 

Alter the do shell script line to read like this: 

do shell script quoted form of rayFath & 

’‘Conients/Rcsourcefl/backup.sh” with administrator privileges 


Our progress bar commands "wrap” the do shell script. Time for the 
test: Apple-S (save) anti Apple-R (build and Run), Make sure that 
your source folder is populated, and click on “Backup". Progress 
bar moves while it’s working, and stops once it s done. Fantastic. 

What if there's a problem? We really want to trap for errors. 
Change the “Do if section to read thusly: 

- Do iU 

try 

do shell script quoted form of myPath 4 
’‘Cant ents/Resources/bac kup* sh " 

on error number 2 hb 

display dialog "Sorry, an error occurred. I catCt make 
the copy," 

end try 


By itself, with no additional parameters, ihis will present the 
user with the familiar dialog box asking for an admin password 
when the app is run. 

Authenticate 

Backup requires that you type your password. 


Name: Edward R Marczak 
Password: 

► Details 



As you can surmise, this allows us to fry a command that may fail, 
without tombing out we get to control the process. I iere, I 
show a basic try block. We try to run the script, If it runs properly, 
returning a zero, alls good and we continue on. If there's a 


(?) ( Cancel ) ( OR; ) 

Figure 6: Our app asking for authentication 
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You can preload your script with a username and password. 
However, I DO NO!' RECOMMEND THIS, Clear? To tie this 
hack into last month's column, it would lx,* trivial for someone 
to run strings across the resulting binary and gather the 
admin level id and password you provided. If you're daring 
enough to risk it, find the instructions in the Apple do shell 
script' technote referenced earlier (but seriously: don’t)* 

One link thing dial TN2065 does not mention: there is a 
default timeout on all AppleScript commands, including do shell 
script, of two minutes, if you Ixdieve your script may run for 
longer - for whatever reason — use a with timeout block: 

with timeout of 300 4o 
do shelf script * 
end timeout 


Unfortunately, there is no setting that will just let it do its thing 
indefinitely (OK, perhaps run a terrible thing). If a command 
does timeout, a timeout error is thrown (-1712). So do make 
sure you use a value large enough to let your script run to 
completion. Even if that's “99999*. 

One for the road 

We'll add one more object to our window: A text Held with the 
current status. Double-click on MamMenu.nib, and once Interface 
Builder is running, click on the Cocoa-Text icon in the object palette: 


Te>‘ 

[| Tesfrl 

Figure 7: Cocoa-Text icon 

Drag two “System Font Text" fields to the main window. Place 
one in the upper left (use the guides), and the second right next 
to it. Double-click on the first, and type “Status:" Into ihe text 
field. Double-dick on the second and type “Idle* into its text 
field. With the second still selected, Apple-8 your way to the 
AppleScript attributes, and name tins field “efStatus*. We should 
also clean this window up a hit while we're here, no? Drag the 
progress bar straight up until the guides appear under the text 
fields we just created. Do the same for the single button, and stop 
when the guides appear under the progress bar. Size the window 
itself appropriately, again using the guides. Save and quit 
Interface Builder, 

Again, we need to make that text field perform an 
appropriate action. Here’s how we can do so. In the “setup’ 1 
section, add this line: 

set the contents of text field "efStanm* of window "wKain" 
to "Copying files.*," 

-.and just after the try block* add this line: 

set the contents of text field “efStatus* of window “wMain" 
to “Backup Complete,** 

Save (Apple-S), build and run (Apple-R) the project with the 
changes* Nice* 


Finally 


lust thing I'll mention: if you really want to make this 
professional, youli probably warn to fix up the app menus to 
show the app’s real name (not “New Application’ 1 ) and add a 
custom icon. Let s tackle the icon first. For this, you 11 need Icon 
Composer. You'll find that with the developer tools in 
/Developer/ApplicationsARilitics. You’ll need to have your 
artwork complete fxrfore using this utility - Icon Composer Is not 
a drawing program. It will, though, read in Photoshop files 
directly. Drag your artwork to the 128x128 pane, scale it if 
needed. From l here, drag the 128x128 to the iHx iH, scale it and 
let the program extract the mask. Rinse and repeat for the last two 
sizes. Apple-S to save. Make sure ‘"Save into bundles* is checked, 
and save the file. You can then take this file and drag ii into the 
"Resources" section of the XCode project. Choose the “Project" 
menu and click on the “Properties" tab. Type in the name of your 
icon file (1 left mine “icons, inis" in die example below), and as 
sexin as you press return, you’ll see a thumbnail representation of 
your application icon. 

r §Q§ Ta rget “Backup* Info_J 

General Build Rules ■ Fnopenle* Comments - 


Executable: SI EXECUTABLE, NAME! 


Identifier: com .apple AS Application 


Type: APPL Creator: W7 

1 P| 

Icon File: icons.iens 


Version: 1*0 




Principal Class: NSApplication 


Main Nib File; MainMenu 


Document Types: 


Name UTI 

Extensions Ml 


+ - 


f Open Info.pftei as File % 


4 * 

(?) 


A 


Figure 8: Project properties and setting an 
application icon. 


To update the menus, we need u> double-dick on the 
MainMenu.nib once again and launch Interface Builder* You 
should notice a small menubar floating just underneath the 
window we've been editing. If not, simply double-click on the 
“Main Menu" icon in the main window of Interface Builder. 
Editing the menu is as simple as double-clicking on each item 
you want to rename. You can alternatively accomplish this 
with the inspector pane, but this method will update the 
inspector as well 
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Figure 9: Menu editing in action. 


Quit and save. Lets build this thing into a tali' a pp. In XCode, 
choose the “Project* menu, and then change ilie “Active Build 
Configuration* to “Release". Save and build (Apple-B) the app. The 
last line of the Build Results window will tell you where tn pick up 
your Universal Binary application! Go get it and double-click to run. 
Exiting, huh? You can now distribute this application, and it contains 
everything that it needs to run - your shell script (the point of thus 
entire exercise, remember) Is bundled inside. 

§ 68 _ Backup_ ^ 

Status: Idle 


( Backup 1 

A 


Figure 10: Our final application, running as a 
universal binary. 
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Bonig and Kallenbach - GERMAN TECHNOLOGY 


Keep it simple 

The goal of thus article was to introduce the oft-overlooked 
capability to easily create a GUI for a shell script using ttx>ls that 
Apple provides for free. While many are aware of this capability, 

I find it “oil-overlooked" by shell scripted, anyway. As 
mentioned earlier in the article, this is certainly not an exhaustive 
look at everything you can do, nor does it even begin to 
approach "Ixjsi practices* (such as exhaustive error checking in a 
try-block, creating a proper info.plist, or even dealing with script 
output). If this introduction intrigues you, there are many, many 
places to increase your knowledge and further this path. 

While I realize that this will run very much alter the fact, 
this publication will appear during WWDC r which will be less 
lively without Michael Bartosh, Friend, fellow tech, fellow 
author and more, he will be sorely missed. Let's all remember 
to raise a glass - even a virtual one - in remembrance. 
Speaking of WWDC, I’m present to raise a real glass with 
anyone interested. See you at Dave's. 

Media of the month: lVe been too lied up in Cifrix tech 
docs and Microsoft Group Policy to recommend anything 
appropriate here from a technical perspective. Actually...that 
may provide the perfect segue: OS X provides Windows 
interoperability by using the open source Samba project. By 
itself, Samba is an ambitious and deep project. Cleverly, Apple 
provides O’Reilly's entire “Using Samira, Second Edition 11 
preloaded onto your Mac! Launch Safari and point your 
browser to <file:///u.sr/share/swat/using_samba/toc.htinl> < This 
tends to be another ‘oft-overlooked' resource. 

1 was fortunate to meet many MacTeeh readers at 
MacWorld in January, and I hope to meet more at WWDC 2006. 
If you're unable lo attend, look for our reports trom the show. 
In any case, HI see you in print next month! 
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Performance Optimization 


Digital Media Boost With 
the Intel® Core™ Duo 
Processor 

Extracting maximum performance from your applications 



Introduction 

This is the second pan of a three part series that 
addresses the most effective techniques to optimize 
applications for Intel® Core™ Duo processor based Apple 
Macintosh computers. Pan one of this series introduced the 
key aspects of the Intel Core Duo processor and exposed 
the architectural features for which tuning is most 
important. Also presented in that first article was a data 
driven performance methodology using the software 
development tools available on an Intel processor-based 
Apple Macintosh to highlight timing and optimization 
opportunities. This article, the second part of this 3-part 
series, introduces the Intel® Digital Media lhx>si technology 
of die Intel Core Duo processor, its capabilities, and how a 
programmer can exploit this computing power. The final 
part of ihis three-part series to come in a future MacTech 
issue will provide readers with the next level of 
optimization - taking advantage of both execution cores in 
the Intel Core Duo processor. 

In this article, we examine the Intel Digital Media Boost 
enhancements to the Streaming SIMD Extension (SSE) features 
of the Intel Core Duo processor. We also desafe how to 
direct the Intel compilers to leverage these features for 
optimal application performance. Finally, we will examine 
inhibitors to the use of these advanced hardware features and 
how to remove some of these inhibitors. Examples will he 
illustrated w ith C++ and Fortran axle snippets. 

Goal: Integer and Floating Point 
Calculations 

Before we dive into the details of SSE and Intel Digital 
Media Ikx)st T let's understand our goals for tills article. 
Reviewing our high-level diagram of the Intel Core Duo 


By Ron Wayne Green and Ganesh Rao 


processor, Figure 1, we see that the processor has Lwo cores. 
Each core is a full-feature, tradition CPU which includes 
registers, instruction pipeline and execution unit, and advanced 
integer and floating point arithmetic units. Our goal for this 
article is to focus on a single core (either one as they are 
equivalent) and look at the hardware provided to accelerate 
integer and floating point calculations. 



Figure 1: Intel r Core™ Duo processor architecture 


SIMD: A methodology for performing 
calculations in Parallel 

Single-Instruction, Multiple Data (SIMD) is a methodology 
for performing the same mathematical operation on a data set. 
Imagine that you have 1,000 elements in two rank-1 arrays, or 
vectors in mathematical terms, and you wish to add lite 
elements of the arrays. Let's call the operand arrays A and B, and 
we wish to store them in a third array, C, as shown l>elow: 

real, dimension{1000} :: a, b. c 
do i-l T 1000 

cti) = a(i) + bU) 
end do 

Or the equivalent loop expressed in Fortran 90 array syntax: 
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c * a + b 


For this example, the “Multiple Data" the term SIMD are the 
1,000 items in each array or vector The "Single Instruction 1 ' is 
the addition operation that we wish to perform on the elements 
of A and R, With an infinite hardware budget, we could store 
the A operands in t T 000 registers within the core, store the B 
operands in another 1,000 registers, feet I the registers in parallel 
into 1,000 addition units which perform the add operation, and 
finally feed the results of [lie 1,000 addition units in parallel to 
1,000 storage registers - all of this in one instruction cycle. Ah, 
idealism! Reality is that our transistor budget on our current 
generation silicon does not allow parallelism on this scale. Also 
one has to remember that any registers you provide to user 
processes have to be saved off and later restored during context 
switching. Our goal is simple: We want to load our operands 
into register files, use parallel arithmetic units to operate on the 
operands, and feed the results into registers or to memory. 

There is another term we need to understand before 
proceeding. Vectorization or Vector Processing is a term 
that has been used in high performance computing for many 
years. It refers to a technique to load a set of registers, 
sometimes called a register file, with operands. After the 
operands are loaded, a single instruction is used to perform a 
mathematical operation on the operands* This differs from 
SIMD in that the mathematical operation specified by the single 
instruction is performed by sequentially streaming operands 
from the registers through the arithmetic unit and back into 
registers - usually with one mathematical operation per dock 
cycle. In SIMD a single instruction operates in parallel on the 
dataset. In vector processing, a single instruction operates on 
the operands in a register file in rapid sequence. 

Inherent in vector processing is the assumption that vectors 
are large. Therefore, caching of this data should be avoided. If 
cache were used as a conduit between memory and the register 
file, accessing a large vector would quickly fill the cache and ii 
would spill without reuse of any element of' the vector. Thus, 
large vector streaming memory access patterns see the cache as 
nothing more than useless overhead. For vector processing, 
direct memory-toregister or cache-bypass techniques and 
instructions are typically used These streaming instructions are 
parr of the SSE instruction set. 

SSE is a hybrid of a pure SIMD model and a pure vector 
model* SSE uses vectorization techniques to stream data 
directly from memory to and from SSL registers (the 
Streaming component of Streaming SIMD Extensions). These 
SSE registers act as a register file, Flowever, the SSE registers 
pack several operands into each 128 bit register and operate 
on them as a set in a data-parallel SIMD model (the SIMD 
portion of SSE), For the remainder of this article we will 
refer to the process of compiling code to lake advantage of 
SSL as vectorization. 

We need to stop at this point for an important 
consideration: These techniques are only efficient when an 
application has enough operands to make the setup costs 


worthwhile. Setup costs include the time to load the 
registers with the elements of A and B from memory and the 
time to unload the elements of C from registers to memory. 
Looking at the DO loop above, if there are only 5 iterations 
of the loop ( operations on just 5 elements in each of A, R, 
and C) then the setup costs may exceed the speedup benefit 
of using the SIMD and vectorization techniques. Also, a loop 
may not be efficient if it contains too many instructions or 
conditionals that wilt break down the vectorization within 
the loop, Loops without enough iterations or with too many 
expressions LhuL will break down the vectorization are 
t e r i n ed in efficient 


Streaming SIMD support in Intel Core 
Duo Processor 

Hie Intel Core Duo processor supports SIMD and 
vectorization with dedicated registers, arithmetic hardware, 
SIMD mathematical instructions to operate on the data in the 
SSK registers, and streaming (cache bypass) memory load 
and store instructions. Each core of the Core Duo processor 
has it's own dedicated SIMD hardware. Figure 2 illustrates 
the SSK hardware available in each core of the two cores in 
the Intel Core Duo processor. This hardware, along with the 
instructions thar drive this special-purpose arithmetic 
resource is referred to as Streaming SIMD Extension, or SSE, 
SSE was designed and has evolved to accelerate integer and 
floating-point calculations. And while the intent of SSE was 
to accelerate common media operations, these same 
mathematical and data movement operations are applicable 
to a wide range of applications in technical computing, 
finance, signal processing, graphics, and gaming to name a 
few. 
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Figure 2: SSE registers and supported data types 


SSE o] 3 erands can he integer: from i byte through 8 byte 
integer types Ixith signed and unsigned. Floating point data is 
supported in 32 or 64 bit IEEE format. As shown in Figure 2, 
the SSE registers are 128bits wide. Thus, these SSE supported 
data types are packed within the registers and operated upon in 
SIMD. Figure Operations on the data can lie addition, 
subtraction, multiplication, division, and some transcendental 
functions such as sine and cosine. 
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Enabling Digital Media Boost 
Vectorization 


The Intel® Fortran and C++ Compilers for Mae* OS allow 
the programmer to generate binaries that take full advantage of 
the Digital Media Boost technology. In fact, the Intel compilers 
will enable vectorization by default when the compiler is using 
optimization level 1 and above ( compiler options -Ol through 
-03). Let’s look at how to enable vectorization with the Intel 
compiler from the Xcode environment. We assume that the 
reader has installed the Intel Fortran or C++ Compiler for Mac* 
OS and has read through the chapter Build Applications with 
Xcode in the Fortran or C++ Compiler Documentation. One 
suggestion: it is best to keep the settings for optimization only 
in the Release configuration lor the target(s). Optimization 
settings can adversely affect the ability to debug an application. 
The first step to enable vectorization is to choose an 
optimization level of I or higher (compiler options -OK -02, or 
-03). Highlight the target for your project, select Get Info 
from Action (see Figure 3). This brings up the Target Info 
window. Again, make sure you arc working with the Release 
configuration for il ie Target 
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Figure 3: Bring up Target Info 


For the Collection pull-down, you have two choices. You 
can view all compiler settings by selecting the Intel® C++ (or 
Fortran) Compiler 9,1 collection (Figure 4), This gives you 
access to the entire set of compiler options for the Intel C++ or 
Fortran compiler. Or as another choice, you can select the 
General collection which is under the Intel C++ or Fortran 
compiler collection (Figure 5). This collection also has the 
Optimization settings. 



Figure 4: All settings from the compiler collection 


Choose any optimization other than None (-00) and 
vectorization will be performed by the compiler. For the 

command line, j 

simply use the compiler options -01 . -02. 

or -03 and 

you are now taking advantage of the SSE 

features of the Intel Core Duo processor. Or are you? The next 

logical question 
my code?*'. 

is itow do I know that the compiler vectorized 
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Figure 5: Optimization settings under General 
Collection 

This brings us to examine how we determine whether or 
not the compiler is vectorizing individual loops. The Intel 
compilers provide a vectorization report option that provides 
two kinds of information: First, the vectorization report will 
inform you which loops within your code are being vectorized. 
The end result of a vectorized loop is an instruction stream for 
that loop that contains SSE instruct ions. This is essential 

information to verify that the compiler is indeed vectorizing the 
loops within the axle that you expect it to vectorize. Secondly 
and what we find critically important, is report information about 
why the compiler did NOT vectorize a loop and why it did not 
vectorize a loop. This information assists a programmer by 
highlighting the barriers thai the compiler finds to vectorization. 
With the Intel compilers, one must enable the vectorization 
reporting mechanism. It is not enabled by default. Within the 
Xcode environment, the vectorization rqx>ri is enabled by 
selecting one of the vector reports in the .setting Vectorizer 
Diagnostic Report from the Diagnostics collection for the Target 
(Figure 6). The vectorization report is viewed in the Build 
Results window. The report follows the compilation for each 
source file, as shown In Figure 7 
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Figure 6: Enabling the vectorization report 
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Figure 7: Vectorization report 


Outer Loops: When there are nested 
loops, the vectorization is applied to the 
innermost loop. OuLlt loops are never 
vectorized, so you can expect -vec- 
report to identify these cases. This can 
be seen by the ouLput of vec-report=3 tn 
the example below; 

$ Ifort -03 -vec-report=2 -o rad rad.f 

tnd,f(212j : (col- 7) remark: loop was 
not vectorised: tiot inner loop, 
rad.f(213) ; (col. 9) remark: LOOP WAS 
VECTORIZED, 

212 do i = l t np 

213 do j - 1,nd 

21A poa(j,i) = pos(j.i) 

+ vel(j,i)*dl + 0.3*tftMt*a(j,i) 

213 veHj.i) = veltj,i) 

+ Q. 5*dt* tf (j .il'mass + a(j.I)) 

2lfi a{j4) = 

f(j,i)*rmass 

217 enddo 

2tfl enddo 

Iii this abbreviated example from a 
molecular dynamics code, we see from 
the vectorization report that only the 
inner loop, the do j=l *nd loop, is 
attempted to f>e vectorized. 

Data Dependencies: In order to be 
candidates for vectorization, a loop 
cannot contain dependencies between 
loop into rati arts. Dependencies occur 
when a strict ordering of the iterations 
must be enforced. Consider the 
following loop: 

void scale(float * z) I 
float A: Int i; 

A - 42.0: 

foe ( i-0: 1(10000: i++ ! 
zfi 1 = A * a[i-U ; I 


The vectorization report option,, vec reports <n>, uses 
the argument <n> to specify die information presented; from no 
information at -vec-report=0 to very verbose information at 
-vec - reports. The arguments to vec report are: 
n^0: No diagnostic information 
n= I: (Default) Loops successfully vectorized 
n=2: Loops not vectorized - and the reason why not 
n=3; Adds dependency Information 
n=4; Reports only non-vectorized loops 
n-5: Reports only nan-vectorized loops and adds 
dependency info 

Inhibitors to vectorization 

I he Intel compilers attempt to vectorize loops witliin the axle. 
However, not all kx>ps can be vectorized. Ihere are too many cases 
to list in die space of this article. We will examine a few common 
scenarios where the compiler cannot vectorize a kx>p. 


Which when compiled gives: 

$ icc -03 -vec- report=2 c depend T c 

depend,c(4) : (col t 2) remark: loop was not vectorized: 
existence nf vector dependence. 

Examining this, we see that in order to calculate the value 
to store in zli) we need to have already calculated the value for 
z[i-lf This forces a strict, sequential ordering to when the 
calculations must be performed. There are many other 
interesting cases to consider in dependency analysts and the 
reader is encourage to pursue this further by researching some 
of the references at the end of this article. 

Function and Procedure calls: Another major inhibitor to 
vectorization is when the loop contains a function or procedure 
call. Consider this example: 

1 c Pi: Compute pi 

2 t 

3 t Illustrates how to calculate the definite 
integral 
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Ac of a function f (x)* 

5 c 

6c We integrate the function: 

7 c f(x) - 4/(l+x“2) 

8 c between the limits x=0 and jt—1, 

9 c 

10 c The result should approximate the value of pi- 

11 c The method is the n-point rectangle quadrature 

rule, 

12 program coraputepi 

11 integer n, i 

14 double precision sum, pi* x* h, f 

15 external f 

16 a - 1Q000G0QGG 

17 h * 1.0/n 

18 mm “0,0 

19 do HI i « l.n 

20 x “ h* £i-0,5) 

21 sum = sura + f(x) 

22 10 continue 

23 pi - h*su» 

24 print *, "pi is approximately : '. pi 

25 end 


Within Lhe do loop a!x>ve t a function call to f(x) Ls made. 
In this example* the function f is in a separate source file. The 
code for f is as follow: 

c fx.f: Integration function 
double precision function f(x) 
double precision x 
f « £4/ (l+x*x)> 

end 


When we attempt to compile these two source file with 
-vee-report, we get the following: 

$ Ifort -03 -vec-report=2 o pi pi,f fx*f 

Pi.f£l9) : ( col 12 ) remark: loop was not veeiurized: 

contains nnvectorizahle statement at line 21 


Looking at pi.f we see at line 19 there is a loop that is a 
candidate lor vector! zation. At line 21 we see the siateinent sum 
= sum + f (x) * It is the call to the external function fix) 
that is Lhe issue. The external function may or may not contain 
data dependencies, thus the compiler makes the safe decision to 
not vectorize the loop 

When one sees function or procedure calls within loops as in 
lias example, tile next logical step is to attempt to inline Lhe function 
call, inlining the function will allow the compiler to complete its 
dependency analysis and often times allow veetorizalion of the loop. 
With the Intel compilers, options -ip and -ipo perform 
interprocedural optimizations. One of these optimization is function 
in lining, - i p is used to inline functions or procedures and perform 
optimizations that are contained within the same source file, ipo 
Is an advanced feature of the Intel compilers. With this option* die 
compilers are able to find inlining and optimization opportunities 
across .source files, as in dlls example. In tills case, fx.f is a separate 
file containing die function fix). Cbm piling with i po gives: 

$ ifart -03 -ipo -vuc-report“2 -0 pi pf.f fx.f 
IPO: performing multi-file optimizations 
IPO: generating object file /trap/ipo ifortOFrakdQ.o 
pi.f09) : (col, 12) remark: LOOP WAS VECTORIZED. 

The runtime of the non-vectorized program took 40 seconds 
on an iMac with a L83Ghz Intel Core Duo processor, lhe 
vectorized version took 17 seconds. We need to point out that 
this was a very trivial ease. Deeply nested and complex 
procedure cal) trees Lhai are called from within a loop will 
almost certainly never he able to lie inlined. 
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Ill-defined loops: Compilers must be able to identify a loop 
and l^e able to determine ihe number of iterations, or trip count 
Here are some example in C and Fortran: 

int count * l: 

while (count 100)I 

*til - *{!+!]: 

count +~ 1; 

\ 

1 = 0 

100 CONTINUE 

Z{1) ~ X(IH) 

I - I + 1 

IF ( I .LT. 100 ) GOTO 100 

Branching outside of the loop; whenever there is a 
conditional branch inside the loop this can disqualify the loop 
as a candidate for vcctorizatinn: 

for ( int i“0; KlOO ;!++)( 

zfi] ~ *li+lj: 

If ( *[i] — 0 ) exlt(-l-); 

I 

Techniques to Improve Vectorization 

We’ve already seen several techniques that improve 
vectorization. These include writing dearly defined loops that 
are easy for the compiler to recognize. Since vectorization Ls 
performed on inner loops, it is especially critical for these inner 
loops. Although it's counter to module programming 
techniques, for efficiency it is best to avoid deeply nested 
procedure calls inside of computational loops. Try to keep 
procedure calls to one level of nesting if at all possible. And 
although we did not mention this earlier, it is much easier for 
compilers to recognize inlining opportunities when functions 
and procedures are within the same source file. However, as 
we’ve seen, if you must have the functions in separate source 
files make sure you use the inlerprcx'edural optimization 
compiler switch, -ipo, provided by die Intel® Fortran Compiler 
and Intel® C++ Compiler for Mac OS. 

Finally, instead of writing your own version of mathematical 
functions, where available use vectorized versions of libraries. As 
an example, the Intel Compilers for Mac OS ship with a shon 
vector math library, libsvml. This library has vectorized versions of 
common math functions normally found in libra The functions in 
libsvml include the common transcendental functions sin/axs/Ltn, 
asin/acas/at*tn as well as exp/pow, and In/loglQ, In addition, the 
Intel compilers provide optimized memepy, mememp functions 
which are also quite prevalent thoughout any application. When 
using the Intel Compilers, this vectorized library will link prior to 
libm. Thus you will automatically link in vectorized versions of 
these common functions. Just remember to use the Intel drivers ( 
ioc/icpc/ifort ) for compiling and linking and do NOT add -lm to 
die link arguments. 

Finally, for more sophisticated mathematical, encryption, 
image processing and statistical functions, Intel provides two 
other library prcxlucts. The Intel® Math Kernel Library (Intel® 
MKL) for Mac OS provides BLAS, FFT, and vectorized statistical 
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libraries. These library functions are highly tuned and optimized 
to take maximum advantage the Digital Media Extensions of the 
Intel Core Duo processor In addition to using SSE, these 
libraries are also multi threaded to lake advantage of both cores 
in the Intel Core Duo processor. Customers performing data 
compression, encryption, video enccxling/decoding and speech 
processing will want lo consider the Intel® Integrated 
Performance Primitives (Intel® IPP}. Intel IPP routines are also 
highly tuned to utilize SSE. 

Summary 

The Streaming SIMD Extern ions (SSE) architectural features 
of the Intel Core Duo processor enable integer and floating poini 
acceleration for applications. SSE is a hybrid of traditional SIMD 
and vector processing methodologies. The Intel Fortran 
Compiler and Iniel C++ Compiler refer to these techniques as 
vectorization. With the Intel Fortran Compiler and Intel C++ 
Compiler for Mac* OS, vectorization is enabled by default at 
optimization level 1 (-01) and above. The Intel compilers also 
feature vectoriziion reporting via the -vec-report compiler 
option. Not only will the report list the location of loops 
vectorized, it will also list the locations of loops that were not 
vectorized and explain wiiy it did not vectorize those loops. 
These hints enable the programmer to indentify vectorization 
inhibitors which can often be removed, leading to substantial 
pe rforma nce i m pn >vciTie n ts 

Further Reading 

A gcxxl place to start learning about SSE and advanced 
optimizations is in (he Optimizing Applications chapter of the 
Intel C++ Compiler or Intel Fortran Compiler documentation 
whit'll comes with the Intel Compilers for Mac OS. The SSE 
features of die Intel Core Duo processor are rich and extensive. 
So much so that a full treatment on this topic requires an entire 
book. The definitive guide to software vectorization and SSE is 
Tile Software Vectorization Handbook . Aart ].C Bik. Intel Press, 
ISBN 0-9743649-2-4. If you are a programmer moving code from 
older Apple machines, using Altivee instructions, there are some 
excellent resources covering Altivee to SSE migration to be 
found on Apple's developer website (ADC). 
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Field Notes 


Do You Copy? 

Are you copying all the information 
about your files that you need? 


Introduction 



The Macintosh environment has always been feature rich, 
and Ilial extends to its files, file attributes* anti file metadata 
the file system maintains for them. OS X has introduced 
Macintosh to a wider array of application environments which, 
aside from dial of Classic, include beasts such as Carbon, 
Cocoa, BSD, X-Windows, Web Objects, Java, QuickTime, and 
now Rosetta, Additionally, OS X supports different file systems 
that support different metadata. All of these may see and 
consider files differently than others. This results in files being 
copied rather differently. 

This article is a short attempt to attune application 
developers, scripters, systems programmers, and File system 
architects to considerations relating to file metadata stored by 
the file systems on Mac OS X. 

Philosophic Questions 

In many respects it is a philosophic question as to what 
each environment on the Mac should properly copy. Some 
environments may not normally or naturally have access to 
all file metadata that OS X maintains for any given file. 
Named Extended Attributes may not be accessible through 
Carbon, Cocoa and Core Foundations, while they may l>e 
accessible from BSD. The nature of die operation may color 
and determine what metadata is important and what makes 
sense for preserving as a copy or whether the metadata 
should be reflective of a whole new file. 

Consider the subtle differences of what metadata, or 
even files, get maintained as pari of the different functions of 
operations like copies vs archives vs backups vs clones vs 
sync vs snapshots, et cetera. Is a copied file a new file or is 
the copy merely a replica or clone? Ibis isn't as easy of a 
question as it first seems. For instance, if you copy a file from 
one location to another, does it make sense to maintain any 
ACLs il may have had or shouldn’t the new file have its own. 
new ACL? But now, what if that “copy” was a backup or 
clone and part of a larger set of Files in its directory? Wouldn’t 
you then expect the ACLs to be maintained? I.ikewi.se, if 
you're backing up a set of files would you expect metadata 
associated with the directory (like sort order, icon positions, 
etc) to lx L maintained for die files? Yet, these are stored in 


places like ,DS_Store or the Desktop Database, not as 
metadata for the file itself. 

What about when we copy files to non-HFS+ file 
systems? What should be maintained? What should be 
expected if a file is copied tiff, then gets copied back? The 
Macintosh has defined the Apple Double formal to store a 
file non-natively. Is it right for a Windows sysadmin to 
delete ..files or T)S_Stores found on their file systems; is 
this "clutter"? To the Mac user who's lost the CODE 
resource of an application file, icons or font resources, a 
file's creation date, or creator/type you may end up with 
torches and pitchforks at your door if you're inconsiderate, 
and confusing if your tools are inconsistent. Bui should an 
ACL get copied to a foreign file system? Maylx? not, but 
other Extended Attributes dearly are in Apple Doubles. 

Moreover, consider what file creation, copying, and 
modification may mean. For instance consider that cat > 
file is often seen as creating a new file, but that if 'file 1 
already existed then this operation is in fact a 11 modification". 

Lastly, in the future we may lie limited as to what we may 
and may not copy through DRM. This may become a technical 
rather than semantic issue as “secure” file systems and files are 
deployed (as in secure for the owners of the content). 

Mac OS X File Metadata and 
Attributes 

Briefly, let's run down some of the most significant file 
metadata and attributes common to Mac OS X. 

Data Streams 

The data fork is well known, but ah Macintosh files 
have at least two forks, a data fork and a resource fork, 
either of which may be of zero length. Implied Ls that 
both exist . Under HFS+ multiple named streams may 
exist, which may be named, but rhe data and resource 
streams may not be renamed. Until Tiger, this was 
merely semantics. 

Traditional views of files are just a single byte stream 
of named data (like found on a tape) with beginningroFftle 
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(BOFs) and cnd-of-file (EOFs), and little to nu metadata. The 
metadata was just “accounting” information used by die file 
system, it wasn't really “the data". However, over the years 
additional information was tacked on by file systems. Users got 
used to this additional metadata for cataloging and sysadmins 
got used to preserving them on backups. Environments became 
more complex and file systems started offering better ways to 
store ancillary data* The Macintosh isn't unique in offering 
multiple streams per file. Even Windows' NTFS has such 
provisions. HFS+ defined an architecture for "unlimited" 
numbers of streams or forks using the Attributes B-lree structure 
on the volume, 

Under OS X the mandatory data and resource forks of a 
Macintosh file are exposed on 11FS+ volumes as filename and 
filename/,mamedfork/rsrc to BSD environments and as filename 
and ^filename when “split” (as for use on foreign file systems.) 
It also introduced tools for splitting and recombining forks split 
into what are arguably Apple Doubles. 

Mac OS X 10.4 Tiger introduced the concept of Extended 
Attributes which implemented and exposed the additional named 
forks or streams on HF$+ volumes and through the 'split' fork 
Jilename on foreign tile systems. ACEs are in turn implemented 
as a privately named and protected Extended Attribute and hence 
are a third fork that files may have on file systems that have ACLs 
enabled. Additionally any number of additional “Extended 
Attributes” (forks) may now be added Lo or read from a file with 
setxattrOi getxatirO, lisixaitrO, and removexattrO. 

Fliidcr Flags 

See 'man GeLFileTnftf for details, hut these include file creator 
and type, attributes bits (such as locked, stationary, invisible), 
creation date and modification date. Stored in the ,.filename Apple 
Double half on file systems other than HFS and its derivatives. 

POSIX 

Files have ownerships (user and group) and permissions. 
Symbolic links also have these attributes. Unix files also 
traditionally carry dates such as atime, mtime, and crime, namely, 
the time of last access, last time file modified, ant! change time 
(last time the file s inode was changed), respectively. Note that 
crime changes after operations like chmod. 

Creation Dates 

The subject of creation dales on the Mac warrants detailed 
discussion in itself. The Mac has always maintained file “creation 
date” metadata, it’s a Finder file attribute, copied along with the 
file by the finder, displayed in (he Finder's Get Info dialog and 
important enough that it is supposed to l>e included as part of 
the Apple Double file information stored in a .Jlle. Rut, while 
Mac users are long familiar with it and often use it to categorize 
files it's a rather foreign concept to unix (mostly because it 
traditionally never existed there), and some unix pundits believe 
it's just woolly-thinking (see http^maiFindex.netbsd.org/netfasd- 
users/2000/11/22/0000html ) or at Irest llte product of the confused 
(see httpr/Ztoadstool se/ioumal/2006/01/n/therialiacy-of-aime ). Other 
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unices and file systems support a btime (birth time) with varying 
degrees of success. 

However, Mac users are used to creation dates , and may get 
rather agitated if they're last or, say replaced with the modification 
time (which seems to be the OS X BSD environment behavior). As 
such, applications should strongly consider properly handling this 
metadata or, if they do mangle it, do so in a manner that lends itself 
to notice (like beginning of epoch). 

For a more detailed commentary of Mac file creation dates 
see htt p ://bl og. pi asticsfutu re.org/2006/06/Z 7/mac-os-fi le-creation-dates/ 

BSD Flags 

BSD lias traditionally maintained a series of (lags associated 
with properties of a file as manipulated by 'chRags\ These 
include flags such as the ‘system immutable flag (schg) that 
prohibit a file from being modified, or the archive flag' (arch). 

The classical Desktop Database and OS X 
.DS_Store files 

Traditionally the Macintosh stored certain metadata regarding 
files in the Desktop Database. Under Mac OS X the ,DS„Store file 
associated with a directory’ contains similar information such as 
directory background info, the position or order of files and their 
icons within a directory, and more. When copying a directory you 
should probably consider copying these. 

Lastly there's one Finder-level piece of information stored, 
disassociated from the file, which brings us to,.. 

Spotlight Metadata 

Tiger introduced us to Spotlight and n huge amount of 
application specific metadata stored that is associated with a file 
based on its content. This data is indexed by the kernel through 
'importers' as a part of normal Derations on the file. 

While most of this doesn’t need to he preserved since it is 
indexed us needed by the kernel, one attribute exposed to the 
Finder and stored in ,DS_Store is what traditionally was known as 
the file Comments, called under Tiger the Spotlight Comments, 
and Is displayed through the Finder’s Get Info dialog. 

How to preserve file metadata 

There a few primary methods by which file metadata get 
preserved: 

* copied natively 

* preserved in special containers or lists 

* preserved by images of the volumes that support them 
(e.g. .dmg’s) 

* split as Apple Doubles 

BSD copies files using copyfileQ which splits to Apple Doubles 
as necessary either internally or externally ( with varying results) 
Note that, currently, copyfileO munges the modified date 
into the creation date field of its Apple Doubles. 


What needs to be copied? 

What doesn’t? 

While mostly a philosophic issue, its probably safe Lo say 
dint traditional Macintosh attributes such as creator and type are 
becoming less important since OS X has various mechanisms for 
associating files with their applications (sometimes at die cost of 
additional metadata) while other metadata, like creation date, 
should arguably be maintained. Spotlight metadata looks like a 
good candidate for general exclusion since the kernel will 
automagically recreate this for installed application importers on 
the target. machine, but all Mac OS X systems might not have the 
same importers installed. This may or may not jnatter. Old 
Desktop Database files probably aren't an issue either as Classic 
withers or is mooted by Intel Macs, but .DS_Stores should 
probably lie maintained if you're backing up a volume. Mandatory 
file forks should always lie copied, but while these are Extended 
Attributes you might consider not copying the other forks that 
may exist, such its ACLs, depending on if you re backing up or 
cloning, or, if you’re just duplicating the file elsewhere on a 
volume. It’s hard to tell currently if other Extended Attributes need 
copying since they're rarely seen in action. 

What Copies What? 

Let's take a look at what metadata, some common tools and 
their operations preserve. The following is not designed to be a 
'■report card” and it’s not my goal to rank or rate a tool for its 
handling of the data, but sysadmins should be aware of how 
operatioas they perform may affect their data. 

Coverage of various third-party backup applications is 
beyond the scope of this article, but it seems they fare rather 
poorly with regard to not preserving Extended Attributes aside 
from resource forks. Creation dues are a mixed bag and may 
vary within the application based on operation (sometimes 
intentionally). For additional discussion, see 
http://bl oa. o lasti csf utu res, ora/2006/03/05/th e-state-of-back up-an d-cl o ni no- 

tool sun der mac-os-x/ 

In general, copyfileO, which most all BSD uxils rely on, 
does not perform consistently compared to the operation of the 
Finder. Creation date is clobbered by the modification date 
despite that copyfileO attempts to use Apple Doubles “internally 5 
and externally to foreign file systems and the Apple Double 
format specifically calls for the creation date. The various tools 
that use copyfileO then quite often fail to properly maintain 
internal or synthetic files resulting in lost Extended Attributes 
and other data. In rare cases the tool may crash, as in the 
instance of trying to 'rsync -aFT a file with lx)th ACLs and an 
additional non-resource fork, named Extended Attributes. 

Apple System Restore (asr) in device mode manages to 
copy all the tested data, but this is to be expected since it is 
essentially a complete copy of the device. In file mode, however, 
asr, Disk Utility, and hdiutil have digressed in their behavior with 
OS X 10.4.6. Where previously it maintained locks (the Finder 
U L" attribute and BSD uchg flags), Extended Attributes and ACLs; 
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it no longer preserves them, though this may change in a future 
update or (although this makes packages and dmgs problematic) 
it may be the intended behavior. 

*dtT hires pretty much us you'd expect. At least 
philosophically it*s understandable. 
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NOTES: 

Darwin Kernel Version 8.7,0: Fri May 26 15:20:53 PDT 2006: 
root:xnu-792.6.76.0bH/RELEASE PRC 

Finder Comments only copied if whole directory copied (that is, if you 
just copy the tile, you must copy the .DS Store) 

X- Copied 
0 - Not copied 

1 - replaced w modification date 

2 - xattr info munged, doesn't display V in Is but Is -te displays ACL, 


attribute becomes non-private 

3 - uchg flags set from Finder locked ("L" attribute) preserved, others 
BSD flags appear lost 

4 - generates warning, cant stat file, not preserved 

5 - even if we dd .DS Store file 

6 - dd ONLY copies data 

7 - dd writes whole new tiles 

8 - no longer displays M +" in Is -le but Is -le displays ACL 

9 - requires "-owners on” 
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VPN Fundamentals (Part 3 of the VPN Series) By Paul T. Ammann 



Using a Mac OS X client 
with a Linux L2TP/IPSec 
VPN Server 


I recently had the good fortune to work with a 
great Open Source VPN Server called Openswan. and 
look the opportunity to learn about connecting ii with 
Mac OS X. NaLurally I couldn't resist writing an article 
about my experience. 

This article will discuss how you can use the built- 
in VPN client of Mac OS X v.10.3 (Panther) or v10,4 
(Tiger) with a Linux Openswan VPN server. If you are 
looking for information about the Mac’s L2TP/TPSec 
client, you can find some of that here as well. 

In addition to LZTP/lPSec, Panther and Tiger also 
support plain IPSec (i.e,. without L2TP). But for this 
feature you will have to edit text files manually or use 
one of the third party GUI clients. Ha in IPSec makes 
configuration on the Linux server much easier. If you 
can use plain IPSec, you don’t have to jump through all 
the hoops as described in this article. I refer you to the 
Openswan Wiki for more information on plain IPSec 
interoperability between Open swan and Mac OS X. 

Apple’s L2TP/lPSec implementation supports 
multiple authentication mechanisms. For “Machine 
authentication" (the IPSec part of the L2TP/IPSec 
protocol) there are basically two methods: Preshared 
Keys (PSKs) and X,3Q9 machine certificates. Tiger’s 
GUI supports both of these methods but Panther’s 
GUI only supports PSKs, PSKs are easier to 
configure than certificates but certificates provide 
better security and in some cases certificates are 
required for supporting Road Warriors. So, Panther 
not supporting certificates for L2TP/IPScc is a pretty 
severe limitation, Once the IPSec authentication 
succeeds, the next step is “User authenticaion" (the 
L2TP/PPP part of the protocol). Tiger supports CHAP 
passwords, RSA SecurED hardware tokens, user 
certificates and Kerberos, Panther supports CHAP 
passwords and user certificates (but these user 
certificates cannot be used for IPSec authentication; 
you will need machine certificates for that). 

Another limitation is that Panther and Tiger 
currently do not interoperate well with most other 
IPSec implementations when NAT is involved A work¬ 
around for this problem has been added to Opens wan 
2.4.2 but there are some issues with iL, There are reports 
that as of Tiger (10,4.4) actually fixes this. 


in a nutshell: there is some L2TP/IPSec support in Mac OS 
X but there is certainly room for improvement. 

Background Information 

Mac OS X 10.3 and 10.4 ship with an L2TP/IPSec client. 
The Mac’s IPSec implementation is based on KAME which is 
known to intemperate with Ope ns wan. I’ve also found the 
possibility of a working setup dial connects Mac OS X’s VPN 
client with a native IPSec implementation of the Linux kernel 
2.6, plus I2tpd and ipsec-tools (racoon). 

L2TP Discussion 

The big question of course is: why w-ould you want to 
use L2TP with the Mac? L2TP/IPScc has the advantage that it 
is an official IETF standard. Furthermore, IPSec is generally 
considered to be more secure than PPTP. As Apple writes, 
'L2TP is Mac OS X Servers preferred VPN protocol due to its 
superior transport encryption and its ability to be 
authenticated via Kerberos" These are indeed valid points: a 
Mac client and an Openswan server can in principle agree 
upon the use of strong encryption (AES, SHA-1, etc,). I have 
not used Kerberos on Lite Mac, so I cannot comment on that. 

Connecting with VSK (Panther and Tiger) 

The GUI in both Panther and Tiger supports PSKs. fve 
provided step-by-step instructions for this procedure: 

1. Open the Application folder. 

2. Open “Internet Connect". 

3. If you see a padlock with the text “VPN (L2TP) n , continue 
with Step 4. If you do not see the padlock, you will have 
to add it: open the menu, choose “File” and then “New 
VPN Connection”. You will be asked to choose between 
“L2TP over IPSec" and “PPTP”. Select “I.2TP over IPSec", 

4. Click on the padlock with the text “VPN (L2TP)", 

5. In the “Configuration” pull-down menu, select “Edit 
configurations.,,”. 

6. Enter the authentication details for your VPN connection: 
the TP address of your Linux server, the “Account Name” 
(“CHAP username), “Use Password” (enter CHAP 
password). Do not use RSA SecurlD, it is not supported by 
Openswan. 

7. Enter “Shared secret”. This is the IPSec PSK that you enter 

in ipsecsecrets on your Openswan server. 
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8, Save settings. 

9, Click Xonnecf . 

10, The L2TP/lPSec canned will he set up. 

If everything is OK then "Status” should say: "Connected 
To”, followed by the IP address of the PPP server on the 
internal interface. 

Connecting with a Certificate (Tiger only) 

Tiger's YPN client GUI .supports both certificates and PSKs 
for IPSec authentication. Panther's GUI only supports PSKs. 
There a re two steps involved: first you import your PKOS#12 
user certificate and then you add a VPN configuration that uses 
this certificate, 

I am not aware of documentation by Apple or a webpage 
which provides any information on how to import a client 
certificate for L2TWlPSec authentication. So I had to come up 
with something myself. This procedure worked for me hut 
may be too complex for some users. Note that I have not tried 
this procedure on Mac OS X versions below 10.43. 

Passwords Overview 

First some remarks on passwords. Passwords are used for 
several tasks on Mae OS X. At several stages you will lx* prompted 
to enter a password. It may not always be clear that kind of 
password will be required at a certain point in time. Here is a short 
overview of the different types of passwords in Mac OS X. 

* login password: this is the password that you use to login 
on the Mac:. The password is set using the “Accounts” 


application by a user with Administrator privileges. 

* Certificate password: this is the password that protects the 

PKCS*I2 file containing the machine certificate. You need 
the password to access the encrypted parts of the file. 

* Keychain Access password: this is the password that you 

enter in the “Keychain Access" application to access the 
"System keychain”. 

* CHAP password: this is the “User Authentication Password” 

that you enter in the “Internet Connect” application. It is 
used in the L2TP/PPP phase of the L2TP/IPSec protocol, 

* Preshared Key: this is also a kind of password but PSKs are 

not involved when you use certificates for authentication. I 
am just mentioning PSKs here for completeness. 

Creating User and Server Certificates 

Certificates will have to be created for the Gpenswan 
server and the L2TP/IPSec clients, I do not provide detailed 
information on generating certificates because it is outside the 
scope of tills article. There is however one tiling that is very 
important when Mac clients are connecting to your Opens wan 
VPN server; the server certificate must contain an ID 
which matches the hostname OTISEICFQDN") or IP 
address (“IPV4_ADDR”) of the server. This ID must match 
whatever you entered in the "Server Address’ 1 field in “Internet 
Connect". Obviously using a fixed IP address as the ID is not 
very r flexible so in most cases you would want to use a 
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hostname in lhe server certificate. Tiger clients will not accept 
a server certificate chat uses a Distinguished Name 
CDER_ASN1_DN) as its ID, such as “C=US, OAGME, OU- 
Research, OU-Spedal Effects, CN-Bart Simpson". Note that 
certificates issued to clients are allowed to contain any type of 
ID. Unlike server certificates there are no restrictions for client 
certificates* 

The exact procedure for adding a hostname or an IP 
address to a .server certificate depends on the software that you 
use to generate the certificate. If you use OpenSSL, you w ill have 
to add one of the following options to the [user_cert] 
section in openssl. cnf before you generate the server 
certificate: 

subjectAitName=DNS : vpiiserver .example .com 

or: 

subjectAitNaro^IP:10.10,12*16 


1eftid^^vpnserver.example. com 
or; 

leftid—123 *123*123.123 

Importing the User's PKCS#X2 Machine 
Certificate 

The following procedure allows you to import one or 
more PKCS#12 certificates for use with L2TP/[P$ec on Tiger: 

L Logon to Tiger as a user will) administrative privileges. 

2. Open the Applications folder, 

3. Open the Utilities folder. 

4. Open die "Terminal” application 


One of these two lines will have to lie added. More 
iaffirmation on lx* found in die Suongsec documentation (see 
References). 

Modifying the Openswan Configuration 

As mentioned above, the server's certificate contains an 
ID that is an IP address or a hostname. The Openswan 
configuration file ipsec ,conf should match this and the 
“Server Address" field: 


5. Type tile following command (all on one line) and press 
Enter: sudo 7Applications/1 ItiIilies/Key chainAccess.app/ 
Contents/MacOS/Keyd i ain Access" (You will need to be 
using an administrator account to make use of sudo) 

6, Enter your login password. 

7* Click the button "Show' keychains" (at Lite left-hand 
bottom), You should now' see a number of keychains at 
the left-hand lop: “login", “X5Q9-roots", "X509- 
certifkates" and “System", 
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8. Click on the “System" keychain. It will lx j highlighted. 

9. From die menu, select Fife -> Import (or press Option-Shift-1). 

10. Select the PKCS.I2 file* 

11. Enter the certificate password 

12. Enter the Keychain Access password. 

13- Typically, three items will lx added to the System keychain 
in tills stage: a private key (grey key symlxil), a root 
certificate (orange symbol) and a machine certificate (blue 
symlxjlX If you examine the details ('summary') of die 
machine certificate or the root certificate, you will notice 
that they are reported as ‘untrusied’. 

14, Drag die root certificate from the "System" keychain to the 
“X509Anchors* keychain. This will change the status of the 
certificates from untrusted u> trusted. (Unfortunately the 
status is not immediately updated hut if you quit Keychain 
Access application anti start it again, you will notice that 
indeed they are now trusted). 



15 Exit the Key Access application. 
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If you did not see any items in ihe “System" keychain, 
then dick “Ail items" in “Category". Il works as a filter so 
perhaps the certificate was actually imported but simply not 
shown because of die filter. 

If you get tliis error: "An error has occurred. 
Unable to import an item. CL_INVAL1D_ 
FIELD_FOIHTER M then you have started the Keychain 
Access application as a normal user That will work fine for 
importing user certificates (in the "login" keychain) but noL for 
machine certificates. You will have to open a Terminal and 
enter the "sudo' 8 command as mentioned above. 

If you get this error: "An error has occurred. 
Unable to import an item. CSP_IMVALJD_DATA” then 
you ty[x*d an incorrect PKCS*12 password. 

Unfortunately there is no indication about which private key 
to which certificate. So should you want to delete a certificate by 
very careful about which corresponding private key you delete. 
Strangely enough you don’t need administrator privileges to 
delete certificates and private keys from the “System" keychain. 
You only iiave to enter your Keychain Access password. 

Alternative Method of Importing the Machine 
Certificate 

If you are a die-hard command line fan you can use the 
utility 'certlooP that is included with Mac OS X. 1 did not look 
into this much because 1) it is less user friendly than the 
procedure described above and 2) I have done only cursory 
testing of ibis procedure. Anyway, here are the commands for 
importing a file named yourcrt.pl2 1 in PKCS#12 format: 

pkcsI2 -in yourcrt.pl2 cacerts -out ea.pesa - 

nokeys 

openssl pkcsJ2 -in yourcrt.pl2 -clcetts out client.pern 
- nokeys 

openssl pkcsl2 in yourcrt.pl2 -nocerts -out key.pern - 
nodes 

cp /System/Library/Keychalns/X5fl9Anchors 
$HGME/Library/Keychains/X!iQ9AnchorE. bkp 
cp /Library/Keychains/System.keychfi i n 
$HOME/Libiary/Keychains/ System.key <: hain.bkp 
certtool i ca.pem k”XS09anchors.bkp v 
cert tool i client.pern r-key.pem f=l 
k=Systern.keychain.bkp v 

sudo cp $I10ME/Library/Keychains/X5D9Anchors/bkp 

/Syst em/ Library/ Keycha I n a /X 50 9 Ann hors 

sudo cp $HOHE/Library/Keycha ins/Syatem.keychain /bkp 

/Lib rar y /Keychains/System.keycha1n 

rm ca.pem client.pem key.pern 

You will lx: asked three times for the certificate password. 
After that, you will be asked for the Keychain Access password 
and then for your login password. 

A special thanks to the author of this Mac OS X hint. 

Adding a VPN Configuration with Certificate 
Authentication 

The GUI is not the only way to configure IPSec on Mac 
OS X. If you are familiar with KAME you could edit KAME’s 
configuration files manually. I have not tried this because this 
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is probably too much to ask for the typical Mac user. 
Advanced users who are able to configure KAME from the 
command line probably do not need the GL1I and the L2TP 
protocol anyway. Wolfgang Hennerbiehler has done this for a 
project. lie writes: 

"OS X creates conftg-files on the ffy hut the main 
mcoon.omf is not touched , instead there's a fine in 
racoon, conf that says: include 

“/etc f recoonf remote/ *. conf" A'o / changed the 
racoon. conf just to my needs (certificates and so on), and 
removed this include line. With that, you can set the 
connection up via the GUI, and racoon will be calk'd by 
the GUI with the correct parameters and the policies will 
be set correctly. This might f?e a problem if you have more 
than l network (different certificates) to connect to. n 

The relevant configuration file can be found on 
HennerbichlerVs website (see References), "Agent Smith* 
provided a similar setup on the Openswan mailing list 

NAT Traversal 

Apple has implemented the IETF NAT-T standard (RFC 
3947) in Mac OS X Panther (10,3.6+) and Tiger (10.4.0-10,4.3), 
Unfortunately, Apple decided to deviate from die NAT-T 
standard in a small but subtle way so that it is not compatible 
with most other IFSec implementations. Supposedly, Tiger 
10.4.4 and higher contain the proper support for RFC 3947 
which would mean that you can also use it to connect to less 
recent versions of Openswan), Mac OS X sends the non- 
standard vendor !1> string “draft ietfipsec-nat-t- 
ike ” instead of "RFC 3947'*. Additionally, according to 
some reports Apple actually implemented draft version 8 of 
the NAT-T standard which was the latest draft Ixfore the 
standard was ratified This draft version is not the final version 
and, in fact, draft 8 jumped the gun a bit because it uses 
invalid ISAKMP payload types which were already allocated to 
RFC 3S47 by I ANA, This means that this stage the NAT-T 
support in Mac OS X will probably not interoperate with other 
IPSec implementations unless they specifically support this 
Mac OS X quirk. Apple’s Mac OS X Server is one of these 
implementations; the Stinghorn L2TP/lPSec Gateway is 
another. Apple’s racoon modifications are available on their 
website, but they are available under the Apple Public Source 
License which unfortunately means that you cannot use these 
modifications directly in Openswan (-GPL) or KAME <=BSD), 
Apple does not want to re-license the code either because of 
legal concerns. 

Peter Van der Beken has created a patch for Openswan 
tlial supports Apple's oddball NAT-T version. This patch has 
been adopted by Michael Richardson of the Openswan team 
and incorporated in Openswan 2,4,5+, Paul Wouters of the 
Openswan team noted that a rekeying problem occurred 
after one hour. Note that even with Openswan 2.4,5+ you 
will still not he able to use NAT-T with a PSK if your 


Openswan server is using KLIPS, This is because the NAT-T 
patch for KLIPS does not support PSKs, You will have to 
switch to NETKEY because NETKEY does support NAT-T 
with PSK authentication. Also note that NETKEY has 
problems supporting the Mac's floating UDP source port. 1 
have also not tried to connect with multiple Macs behind the 
same NAT device so l do not know if that is supported. 

1 hope that one day Apple will see the light and release a 
Software Update for Mac OS X that conforms to the official NAT- 
T standard and/or drafts. Because Apple’s racoon version is 
based on KAME s racoon which has been discontinued, there is 
a chance that Apple will l>e forced to switch to ipsecTools 1 
racoon which is still in development. This would be great news 
because ipsec-tools Ls originally a Linux pon of racoon so 
interoperability wit!) Opeaswan should lx? excellent. Other USD 
versions such as NetBSD have already switched to ipsec-tods. 

Perfect Forward Secrecy (PFS) 

Perfect Forward Secrecy (PFS) provides extra security. 
When you enable PFS, you adversaries (hackers, competitors, 
law enforcement, the mob, etc.) cannot decipher packets senL 
through the IPSec connection, even if they can eavesdrop on 
the encrypted connection and they have your secret key 
(through hacking, court order, escrow, etc.). This property of 
PFS is also known as escroufadage. 

In the ipsec .conf file, there is a line: 

[ i fB^no 

Tills line is required because Mac OS X L2TP/LPSec client 
do not enable PFS. Openswan, on the other hand, enables PFS 
by default. One could only speculate why PFS is not used by 
Apple as a default. Is it lx j cause of the Kinsert your favorite 
Metier government agency>? 

Mac OS X does not propose PFS by default. 1 don’t know 
liow to enable PFS through the Mac OS X GUI (e.g.. the 
"Internet Connect” program). There is no mention of a “PF5 n 
setting. I suppose the default racoon , conf can he modified 
so that PFS is enabled but I haven't tried that. 

AES, SHA-1, DPD, and ICOMP 

By default, Mac OS X will propose ISAKMP SAs and 3DES 
encryption. HMAC authentication based on SHA-1 hashes and 
DM group 2 (MODP I024). These are reasonable defaults and 
Openswan will accept them. 

Mac OS X will also propose IPS PC SAs with either 128-bit 
AES or 168-bit 3DES encryption and HMAC authentication based 
on SHA-1. These' am used for the bulk encryption so they affect 
the throughput of the L2TP/lPSec connection. Older versions of 
Openswan will use 3DES and SHA-1 for IPSec SAs by default. 
These are good defaults for Windows clients that use the built-in 
IPSec slack. However, Mac clients also support AES, which is 
much faster than 3DES, so you might want to enable AES support 
in Openswan. For instance, by adding the following lines to the 
connection seclionfs) in your ipsec.conf; 

ike=aes sha.3dee-sha 
esp-aes-shal * Sties slia 1 
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The Mac OS X configuration file racoon . conf contains 
a line that should enable the deflate type of IPSec compression 
(IPCOMP) far its IPSec $As. But it seems that the Mac OS X kernel 
does not support it, I don't see an IPCOMP header in the packets 
that the Mac sends. Opens wan supports IPCOMP deflate but by 
default it does not enable it. You can enable deflate compression 
by compress^yes to the connection seciion(s) in your 
ipsec, conf. But dlls will not result in actual use of IPCOMP 
Ixxause the Mac OS X kernel docs not seem to support it. 

Dead Peer Detection is not supported by Mac: OS X’s 
racoon. U is based off an old KAMR version that lacks DPD 
support. More recent racoon versions (i.e. those in IPSec-Tools 
Package) do support DPD. 

Troubleshooting 

In case of problems, you can open the "Connection 
log". You can find it in the menu under "Windows". For 
even more detail, you can examine racoon's log file at 
/private/var/log/system,log. 

Here is an example of a problem 1 ran into and how I used 
system* log to trace die cause. I had defined a connection 
on Mac OS X for a certain server, I had installed another server 
with the same configuration and I wanted to test it as well, so I 
simply changed the IP address in InLemet Connect's main 
window* I did not change the username, password and shared 
secret. Since l imi not changed them, I figured that die same 
settings would be used to connect lu the second server. It 
turned out that this was nor the case for the shared secret. When 
entered in the "Edit configuration.,," window, the shared secret 
is specifically for the server whose IP address you entered there 


(apparently the Keychain application stores shared secrets in 
such a way that they are Ixxind to an TP address). I got die 
following error in system, log: 

Nov 15 12:02:17 locaihost racoon: ERROR: 

oakley , c : 2071 :oakley_skeyid (J : couldiYt find -the pskey 

for 192,168.0.111. 

I had to go to "Edit configurations,,." window and change 
the IP address there. You cannot change the IP address in 
Internet Connect's main window and expect it to work. 

VPN Alternatives for the Mac 

The built-in VPN client is not the only VPN client for Mac 
OS X. There are others as well. None of them supports 
LZTP/IPSec, though, 'Hie following produces are basically 
front-ends for the Mat: OS X’s built-in IPSec clients, 

1 IPsecuiitas from Lobotomo Software adds a graphical 
front-end to die built-in IPSec core, "allowing you to set up 
secure communications within minutes". It is freeware and 
known to interoperate with Openswan, KAMI (racoon) and 
NETKEY, Ir contains a Certificate Manager (Actually, I believe it 
uses KeyChain for this). A how-to with screenshots for 
connecting with IPsecuritas to an Openswan server is available, 

hdp://wwwlobotoma.com/product5/lPSecyritas/ 

2. VaporSec: Mac OS X v!0.2+ contains IPSec support 
through KAMF, but does not support L2TP/lPSec. VaporSec is a 
free user interface for KAMI which is normally configured 
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through ASCII configuration files. VaporSec creates IPSec 
policies that will allow you to connect to other IPSec: devices. 
This may lie another Mac OS X vI0.2+ machine or a third-party 
firewll, VTN or other IPSec device. 1 think il has been tested with 
FreeS/WAN. 1 see no mention of compability with Mac OS X 10.3 
Panther, but accord to Patrick Tschudin, it does work, 

htto://www, afD548.com/SoftwareA/aporS9c/ 

3. VPN Tracker from Equirmx is a commercial IPSec 
client for Mac OS X, They make a couple of statements: 

(a) "Panther only supports a special protocol and not 
the standard IPSec” 

This is not quite true. Mac OS X’s GUI only supports 
L2T1VIPSec, which is not a “special protocol” but an official 
IETF standard (RFC 3193). It is simply L2TP tunneled within 
IPSec . And if you are comfortable with Mac OS X command 
line, you are probably capable of using standard IPSec. It's just 
that VPN 'tracker automates that for you with a very nice GUI. 

(b) "Therefore it s not compatible with most third patty 
devices out there * 

That's because not all third party devices currently support 
IZTP-over-IPSec, but the number is increasing. L2TP is used by 
Microsoft, Cisco, Checkpoint and other vendors to allow remote 
users to obtain an IP address from die internal network. Plain 
IPSec cannot do that. I’m not saying that LZTP is the best solution 
(IKEv2 seems much more interesting) but it is a ratified standard 
and it is already supported by many clients and servers, 

(c) "VPN Tracker on the other hand with predefined 
connection types for the, majority of VPN 
manufacturers and extensive interoperability bow4o 
documents are available for most setups ", 

in a perfect world you should not have different connection 
types for different vendors because all vendors would adhere to 
the same standard and implement it without interoperability 
issues. In practice, things are different, I itave not used all third 
party devices supported by VPN Tracker but the ones I did test 
are generally compliant with the standards. Nevertheless, I think 
it is a big plus dial VPN Tracker has identified remaining issues 
and provides neady-to-use configurations. 

(d) “A complete certificate management solution with 
built in CA features and an import/export that enables 
an easy rollout for enterprise scenarios”. 

1 think this feature is only in the Professional version of 
VPN Tracker and you wont need CA functionality if you only 
want to use it as a client and you have made your ow r n 
provisions to generate your certificates. I must admit that from 
the screenshots it looks very nice. 


httD://www,equinux.com/u5/Droducts/vp ntrack 9r/faq.html?cat=VPN‘ 

Tracker-FAQ#22 

The clients above all support plain IPSec (without L2TP) 
which has its advantages and disadvantages, there are also 
other VPN alternatives: 

1. Mac OS X supports PPTP. This VPN protocol has its 
advantages and disadvantages, compared to L2TP/IPSe, In a 
nutshell. PPTP is not an official standard. 

2. Apani Mac OS X VPN Client: Known to work with 
Nortel Network VPN Router (formerly Confiviiy). Status 
unknown with Openswan. Pricing and licensing terms not 
known to me; may not make such sense to use this client. 

3. Cisco VPN Client for Mac: Uses IPSec with XAUTH 
(extended authentication) which is supjiorted by only a few 
other vendors. XAUTH support is currently in development on 
Openswan. I do not know if this client will work with it, or 
the licensing terms of this client. It may not make financial 
sense to use the Cisco c lient with Openswan. The Cisco VPN 
client can only be downloaded from the Cisco website with a 
valid CCO user ID. You will need up-to-date versions of Mac 
OS X and die Cisco VPN client. 

4. Checkpoint SecureClient: Status unknown with 
Openswan, Pricing and licensing terms not known to me, it 
may not make much sense to use this client, 

5. DigiTiiiinel from Gracion is a PPTP client which has some 
extra features over the built-in Mac OS X PPTP client, such as split- 
routing (many companies consider ibis a security risk, though). 

6. OpenVPN is an Open Source project with clients for 
Windows, Linux, Mac OS X, Solaris, etc. 
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□Work Longer? □ Work Harder? 


How to Stop 

Racing the Clock. 


□ Energize Your Mac! 


We know your day keeps getting longer and longer. With every release of software, your Mac is 
bogged down even more. With every dick, there's a pause. You find yourself working longer, working harder. 
A faster Mac means that you can work faster, not harder - be more productive! 


Let the original Mac Performance Shop help. Day star has been creating Mac speed for over 16 years. 
Whether your bottleneck is storage, connectivity or just raw CPU speed, we deliver the performance you 
need, where you need it. 



CPU Upgrades for Raw Speed. We upgrade any Power Macintosh, 
any iMac Flat Panel, any PowerBook G3 and some PowerBook G4s. 

Fast and Large Storage for Real-Time Video. Our TURBOS^M 

solutions can make your drives perform like RAM. Projects open in a 
flash and edit in real-time. 

Extreme Wireless. Wireless is great, unless you're getting slow 
transfers. Even Airport Extreme's are slow when the signal is weak. 
Daystar can boost your signals and energize your wireless network. 

But, if You Really need a G5? Daystar is the onfy Mac Performance 
Manufacturer that is also an Apple Authorized Reseller. Not only can 
you trade-in your system for the latest and greatest... but the Daystar 
Pro's can upgrade it for maximum performance! 

Call 877-439-8646 and beat the clock. 

Authorized Reseller 


Daystar 

i * ■ V inijT E C H N Q L O G Y 


Daystar Technology - Your Macintosh Performance Shop 

5018 Bristol Industrial Way, #202, Buford, GA 30518 USA 
Toil Free: 877-439-8646 or 770-614-5400 


Daystar-Tech.com 


Daystar-Forum.com 


Daystar-Store.com 
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